What it does

One link, one read, then ash. Here is everything that link can carry, and everything you stay in control of.

Live 2FA codes

Authenticator codes die every 30 seconds, which makes them miserable to share. A screenshot is stale before it arrives. Onetime auth shares the ability to generate codes, not one code: paste the setup key or drop in the QR image, and your recipient sees a live code that keeps rotating in their browser while they log in.

• Works with anything that uses standard authenticator codes: Google Authenticator, Authy, Microsoft Authenticator, and the rest.
• QR images are read on your device. The image is never uploaded.
• The code is computed on their device too. The seed stays sealed inside the link the whole way.
• Their viewing session is short and wipes itself when it ends.

Full logins in one link

Handing over an account usually takes three messages: the username here, the password there, "I'll text you the code when you're ready." One share carries all of it: username, password, a live 2FA code, the sign-in URL, and any notes. They open it once, sign in, and the link is gone.

The form starts as a single password box. Add the fields you need, skip the ones you don't, and use the built-in generator when you are creating the password rather than sharing an old one.

Secret requests

Sometimes the problem is the other direction: you need a password from a client who will otherwise email it to you. Send them a request link instead. What they type is sealed in their browser to a key only you hold, inside a pickup link that never left your machine. You read their reply once, then it burns. They need no account and nothing explained beyond "click this."

Create a request

You stay in control

And none of it is readable by us

Everything above happens on top of the same rule: secrets are encrypted on your device, the key travels inside the link, and our servers only ever store a sealed box. How that works

Share a secret