How do I share a password securely?

Type it into the box above and send the link that comes back. The password is encrypted in your browser before it leaves, and it is deleted the first time someone opens the link. Unlike a chat message, it does not stay in the conversation history where anyone with access to the channel can scroll back and read it later.

Can Snapy read the password I send?

No. Your browser generates a random 256-bit key, encrypts the password locally, and puts the key in the part of the link after the # symbol. Browsers never send that part to a server, so it is absent from server logs and from the database. Snapy stores encrypted text it has no key for.

What happens when the recipient opens the link?

They see a page with a Reveal button. Pressing it deletes the stored copy and decrypts the password in their browser. The link then stops working for everyone, including them.

Will a link preview in Slack or Discord burn the secret first?

No. Chat apps fetch pasted links to build preview cards, so revealing is a deliberate button press rather than something that happens when the page loads. A preview bot can fetch the page all it likes without consuming the secret.

How long does a one-time secret link last?

You choose: 1 minute, 5 minutes, 15 minutes, or 1 hour. Five minutes is the default. Whichever comes first, the open or the expiry, ends the link, and expired secrets are deleted from the database by a scheduled sweep.

Can I add a passphrase as well?

Yes. A passphrase is mixed into the encryption key inside your browser and never sent to the server, so the link on its own stops being enough to open the secret. Tell the recipient the passphrase through a different channel. If they type it wrong the secret is destroyed, so allow two opens when you use one.

Do I need an account?

No. Sending a one-time secret needs no account, and neither does opening one.

One-time secret

Share a password securely, with a link that destroys itself

Type the password, get a link, paste it in chat. The first person to open it sees the password once, then it is deleted. Encrypted in your browser, so the key never reaches the server.

The password, key, or note 0 / 4000

Dies after

Opens allowed

Add a passphrase

Mixed into the encryption key in your browser and never sent to Snapy. The link on its own stops being enough, so tell them the passphrase some other way — by voice, or in a different app. If they type it wrong, the secret is destroyed, so allow 2 opens if you use one.

🔒 Snapy cannot read it — the key is in the link, never on the server. Opening it deletes it. Lose the link and the secret is gone for good.

A password in a chat message never goes away

Pasting login details into Slack, Discord, Teams, or email publishes them to a permanent, searchable log. Everyone in the channel can read it. Anyone who joins later can scroll back to it. It sits in the workspace export, in the backup, and on every device that synced the conversation. Rotating the password later does not un-send the message.

A one-time secret link fixes the shape of the problem rather than the wording of the warning. The link is what goes into the chat, and the link stops working as soon as it has been used.

How the one-time link works

Type the secret. A password, an API key, a connection string, a recovery code.
Your browser encrypts it. A random 256-bit AES-GCM key is generated locally and the text is encrypted before anything is sent.
Only ciphertext is stored. The key is placed in the URL fragment — the part after the # — and browsers never include that in an HTTP request. It is not in the access logs, not at the CDN, and not in the database.
Send the link. Paste it wherever you would have pasted the password.
It burns after reading. The recipient presses Reveal, the stored copy is deleted, and the text is decrypted in their browser.

This is what zero-knowledge secret sharing means in practice: the server holds an encrypted blob and no key, so a database dump is worthless on its own, and there is nothing to hand over, leak, or subpoena.

What you control

Expiry — 1, 5, 15, or 60 minutes. The secret dies on the timer even if nobody opens it.
Opens allowed — 1 by default, which is burn-after-reading. Allow 2 or 3 for a recipient who might fumble the paste.
Optional passphrase — mixed into the key in your browser, so a forwarded link is not enough by itself.

Deleted, not marked as read

A self-destructing link that only flags a secret as opened still has the secret sitting in a table. A one-time secret link on Snapy runs a delete: when the last allowed open is used, the row goes. There is no plain-text column anywhere in the design, and no "recover my secret" feature, because either one would mean holding what this page promises not to hold.

The honest consequence: a lost link is a lost secret. Nobody can re-send it or look it up, including Snapy. Send a new one.

Preview bots do not eat the secret

This is the detail that quietly breaks many self-destructing message tools. Slack, Discord, WhatsApp and Outlook all fetch a pasted URL to build a preview card, and security scanners open links in email automatically. If opening the page were enough to consume the secret, the preview bot would destroy it seconds after it was sent — and the sender would get blamed for a link that "didn't work".

So the view page is inert when it loads. It renders, it checks whether the secret is still there, and it waits. Revealing takes a deliberate press of a button, which a bot does not do.

Good for

Handing credentials to a contractor or a new hire before they have a password manager seat. Sending an API key to a developer on another team. Giving a client a temporary login. Passing 2FA recovery codes to someone during an account handover. A WiFi password to a guest. Anything you are about to paste into a chat window and would rather not leave there.

Send a file the same way

A one-time link is for text. To send a document with a password, an expiry date, and a record of who opened it, use secure document sharing or share a PDF as a link. Related: document tracking and sharing documents with clients.