Why you shouldn't email passwords
An email doesn't disappear when you delete it. It sits in your sent folder, the client's inbox, both providers' backups, and every device that syncs that account. If any one of those is breached next year, the hosting login you sent today goes with it. A secret link changes the math: the email only contains a pointer, and the pointer stops working after it's opened once.
How this tool protects the secret
- Encrypted before it leaves your browser. We generate a random 256-bit key on your device and encrypt the text with AES-256-GCM, the same standard used by banks and password managers.
- The key never reaches us. It's placed after the
#in the link. Browsers keep that part local and never send it in a request, so our server stores only ciphertext it has no way to decrypt. - Burn after reading. When the last view is used, or the timer runs out, the encrypted record is deleted. There's no archive and no "undo".
- Encrypted attachments. Attach up to three files (10 MB each), such as a contract, an SSH key or a recovery-code PDF. File names are encrypted too, so the server can't see what you sent.
- Scanner-proof. Corporate email filters open links to check them for malware. Your client has to click Reveal, so a robot can't quietly use up the view.
The strongest way to send a login
Split it across two channels. Email the link, then text or call with the passphrase. An attacker who has the inbox still can't open it, and someone who sees the text has nothing to type it into.
Subject: Your website login Hi Dana, here's the WordPress login for your new site: https://websiteblueprints.tech/s/#3f9a...c1.Xk2... It opens once and expires in 3 days. I'll text you the passphrase.
Good habits for client handoffs
- Use a strong, unique password. Our password generator makes one in a click.
- Ask the client to change it after first login, and turn on two-factor authentication.
- Set views to 1 for passwords. Use 2 or 3 only when several people genuinely need to open it.
- If the link shows as already viewed when your client opens it, assume it was intercepted and change the password.
Handing over a domain too? Check the records with our DNS lookup before you share registrar access.
Frequently asked questions
Can Website Blueprints read my secret?
No. Your browser encrypts the secret before it is sent, and the decryption key is in the part of the link after the # symbol. Browsers never send that part to a server, so we only ever store encrypted data we cannot read.
Why does my client have to click Reveal?
Email security scanners in Outlook, Gmail and others open links automatically to check them. If the secret appeared on page load, a scanner could use up the only view before your client sees it. Requiring a click stops that.
What happens after the secret is viewed?
When the last allowed view is used, or the expiry time passes, the encrypted data is permanently deleted from the server. The link then shows that the secret is gone.
Should I add a passphrase?
For anything important, yes. Send the link by email and the passphrase another way, such as a text message or phone call. Someone who gets into the inbox alone still cannot open the secret.