Blog
Notes on sharing secrets.
How OOBSecret works underneath, what it deliberately does not do, and why passing a credential is harder than it looks.
More posts
- What is a passphrase, and how many words does it need? A passphrase is a string of random words: as strong as a random password and far easier to type or read aloud. How many words you need, why they must be random, and where a passphrase beats a password. Concepts
- How to generate an API client ID and client secret A client ID names an application and a client secret proves it. How long each should be, which format to use, why prefixes help, and how to store and hand over the secret safely. Engineering
- How to decode and verify a JWT A JWT is readable by anyone who holds it, and trustworthy only once its signature checks out. How the three parts work, what the claims mean, why signatures fail, and how to handle tokens safely. Engineering
- Static vs dynamic QR codes, and how to make one that scans A static QR code holds your link itself and never expires; a dynamic one routes every scan through someone else. Which to use, what a QR code can hold, and how colour, size and contrast decide whether it scans. Practice
- What is a phishing link? How to check before you click A phishing link imitates a service you trust in order to take your credentials. The signs worth checking, in order, and why a genuine one-time secret link trips some of the same alarms. Practice
- One-time secret vs one-time password: what is the difference? A one-time password is a login code that proves who you are. A one-time secret is a link that delivers a credential to someone else, once. Same name, opposite jobs. Concepts
- How to share a WiFi password (and when not to) The fastest way to share a WiFi password depends on whether the person is standing next to you. Phone-to-phone sharing, guest networks, finding a password you have forgotten, and what to do for someone remote. Practice
- How to share credentials with contractors Contractors sit outside your password manager and their access has an end date. A practical process for granting, handing over and revoking credentials. Practice
- The best ways to share passwords securely A ranked, honest guide to sharing passwords with colleagues and clients: what to use for ongoing access, what to use for a one-off handover, and what to stop doing. Concepts
- What is a one-time password link? A one-time password link sends a password or API key through a URL that self-destructs after it is read. How they work, and when to use one. Concepts
- How the key stays out of our database Everything after the # in a URL is never sent to the server. That one detail is the whole OOBSecret architecture. Security model
- Link previews are eating your one-time secrets Slack, Teams and Outlook fetch every URL you paste. So do mail scanners. Here is what that does to a view counter, and the fix. Engineering
- Out of band, in plain language The phrase comes from telephone engineering and gets used loosely in security. What it means here is narrow and useful. Concepts
- Why there is no account, and what we give up for it No login means no audit trail, no revocation list and no delivery confirmation. That trade is deliberate. Product
- Deleting is not the same as forgetting A row disappearing from a table is the easy part. Backups, replicas and write-ahead logs are where permanent deletion usually turns out to be a figure of speech. Engineering
Got a credential to hand over?
No account needed. Paste it, set the limits, send the link.
Share a secret