Skip to content
SafeHanded Docs

Send a secret

Send a secret is the outbound direction: instead of requesting a credential, you send one — to an end user, a client contact or a colleague — as a one-time link. It replaces tools like Password Pusher and Bitwarden Send, with the same audit trail, branding and ticket lifecycle.

Send one

Section titled “Send one”
  1. Click Send a secret (on the Shares page or the dashboard, or from a ticket link).
  2. Type or paste the Secret (up to 4 KB) and an optional Note. Attach files if needed.
  3. Say who it’s for: Client (MSP mode), the recipient’s name, and their email or mobile if SafeHanded is to send it. You can also link a ticket.
  4. Set the options (below).
  5. Deliver — copy the link, show a QR code (for a walk-in customer to scan), or have SafeHanded email or text it. An emailed or texted link goes without its key: you then give the recipient the key yourself (below).

Your browser generates a random key, encrypts everything, and posts only ciphertext. The link is https://safehanded.com/s/<token>#<key> (or your custom domain in place of safehanded.com) — the key lives in the URL fragment and never reaches the server, not even when SafeHanded sends the link for you.

Section titled “Emailing or texting the link”

To make sure SafeHanded never sees the key, a link it emails or texts for you arrives locked: SafeHanded sends https://safehanded.com/s/<token> only. You unlock it for the recipient in one of three ways, now or later:

  • On a call: read them a 6-digit code. Click Start call handover and read out the code shown. They choose Type the code on their page, type it, and the secret opens. The code is not the key and is useless once used. Keep the share page open until they are in. Each code allows only a few tries, and a share allows a limited number of typed codes in all; after that, use one of the other ways. Read the code only on a call you placed or expected, to the person you meant to send it to.
  • The key words. The key as 24 words, to read out or copy (Copy key words). They choose Enter the key words on their page. The words are checked as they are typed, so a mistyped word, or a key from a different secret, is caught before a view is used.
  • The whole link (which includes the key), sent by your own chat or ticket, or shown as a QR code.

Later, from the share page. Your organisation can keep the key for you in your key locker (on unless an Admin turns it off). It is locked to your own key, so SafeHanded cannot read it, and only you can open it: on the share’s page, click Give the key and confirm with your passkey to show the key words, the whole link and its QR code, or to start a call handover. The locker is deleted the moment the share is first viewed, or when it expires, is revoked or is purged. Opening the link yourself uses one of its views. The key is only kept when your vault is open in the browser you create the share from; otherwise the screen says so, and you give the key straight away.

A share sealed to the recipient’s passkey has no separate key: only their passkey opens it, so it is safe to email or text as it is. When the address belongs to someone who has set up secure delivery, a Seal to their passkey switch appears, already on. For a member of your organisation it’s Seal to their vault: they open it signed in to SafeHanded (your own team). Before sealing, your browser checks their key (see How keys are checked).

If you choose the emailed one-time code and also email the link, both land in the same inbox, so the code adds nothing. Text the link, or use a passphrase, for a real second factor.

Options

Section titled “Options”
  • Expires after — 15 minutes to 30 days, up to your policy’s maximum (7 days unless an admin changes it). The default is 24 hours.
  • View limit — 1 to 10 views, up to your policy’s maximum (default 3). The share is destroyed after the last view.
  • Extra protection — a passphrase (at least 8 characters, which you give the recipient another way) or an emailed one-time code (or a texted one, if your organisation allows SMS codes), required before the link opens. Your policy can make one of them compulsory; a secret sealed to the recipient’s passkey counts, as their passkey is the gate. Never send a passphrase through the same channel as the link.
  • Notify me when it is viewed — on by default.
  • Ticket link — optional; if set, the share is noted on the ticket and purged when the ticket closes, exactly like a request.

What the recipient sees

Section titled “What the recipient sees”

They open the link, type the code you read them or give the key words if the link was sent without its key, pass the passphrase or code if set, then see the secret with a copy button (and an offer to clear the clipboard afterwards), and can download any attachments. Each view is audited. The share expires after the view limit, the time limit, or when the linked ticket closes — whichever comes first.

Section titled “Related”