What is a one-time secret link?
A one-time secret is temporary private text—such as a password, recovery code, or API token—delivered through a link designed to stop working after its first successful retrieval.
One-time secret is not one-time password
A one-time password is an authentication code generated for a login. A one-time secret link is a delivery mechanism for arbitrary private text. VanishKey can carry a password or code, but it does not generate authentication challenges or replace multi-factor authentication.
The link is the capability
Possession of the complete URL authorizes one reveal. Its sensitive fragment remains after the #, which ordinary browser HTTP requests do not send to the server. The recipient's browser uses that fragment to authorize retrieval and decrypt locally.
Deletion narrows exposure; it does not erase recipients
Atomic retrieval prevents a second server retrieval, but a legitimate recipient can still copy, photograph, or store the revealed plaintext. One-time delivery protects the handoff—not what a recipient does after disclosure.
Good uses
- Initial passwords that must be changed at first login.
- Recovery codes or temporary access tokens.
- Bootstrap credentials between an operator and an automation agent.
- Private notes that do not belong in persistent messaging history.
Share the secret—not a permanent copy.
No account. One reveal. One-hour maximum lifetime.