Blog
Notes on sharing secrets.
How OOBSecret works underneath, what it deliberately does not do, and why passing a credential is harder than it looks.
More posts
- The best ways to share passwords securely A ranked, honest guide to sharing passwords with colleagues and clients: what to use for ongoing access, what to use for a one-off handover, and what to stop doing. Concepts
- What is a one-time password link? A one-time password link sends a password or API key through a URL that self-destructs after it is read. How they work, and when to use one. Concepts
- How the key stays out of our database Everything after the # in a URL is never sent to the server. That one detail is the whole OOBSecret architecture. Security model
- Link previews are eating your one-time secrets Slack, Teams and Outlook fetch every URL you paste. So do mail scanners. Here is what that does to a view counter, and the fix. Engineering
- Out of band, in plain language The phrase comes from telephone engineering and gets used loosely in security. What it means here is narrow and useful. Concepts
- Why there is no account, and what we give up for it No login means no audit trail, no revocation list and no delivery confirmation. That trade is deliberate. Product
- Deleting is not the same as forgetting A row disappearing from a table is the easy part. Backups, replicas and write-ahead logs are where permanent deletion usually turns out to be a figure of speech. Engineering
Got a credential to hand over?
No account needed. Paste it, set the limits, send the link.