They open your link on a page with your organisation’s name. The password is decrypted on their device, and the link stops working after the views you allowed.
The page says who sent it and shows your organisation’s name and logo. Verify your domain and it also says SafeHanded has checked you control it, so it doesn’t look like phishing.
The secret is encrypted in your browser before it leaves. The key sits in the part of the link after the #, which browsers never send to us, so we only ever store ciphertext.
Every view counts, and they can see how many are left. After the last view (3 by default, up to 10) or at expiry, from 15 minutes to 30 days, the secret is destroyed.
Anyone can paste a link into the free Verifier. It tells them whether the link was genuinely issued through SafeHanded, who by, and whether it’s still live.
Try the Verifier →With secure delivery, the secret is sealed to the recipient’s passkey. A forwarded or leaked link opens nothing for anyone else.
See secure delivery →Give a new starter their first password as a QR code at their desk. Link a share to the ticket so it’s destroyed when the ticket closes. Need a password back? Send a request instead. Every step lands in a signed audit log you can verify.
Sign in with Microsoft, Google or email, and send your first secret.