Generate a strong password in this browser, then save it in a trusted password manager. The proposed one-time sharing service below is not active; this page does not upload or send secrets.
Password sharing is not active. Use the customer's approved password manager or access-provisioning process to deliver credentials.
✓ Password generation stays in this browser✓ No secret-sharing endpoint✓ Approved channel for delivery
Choose length and character types. Randomness comes from this browser's cryptographic API.
No password generated.
This page generates a password but does not transmit or save it. Copying places it on your clipboard, which other apps on this device may be able to read. Leaving the page clears the displayed result, but cannot guarantee memory erasure or clear the clipboard. The PFX preset only chooses characters; it does not create a PFX file. Clear the result when finished and share credentials only through a customer-approved channel.
A practical guide to password sharing
Learn when to avoid shared credentials, how to use an approved vault, and what to verify before granting access.
This flow is disabled unless this page is explicitly configured for the same-origin /api endpoint. When enabled, it can share only a fixed synthetic marker, never a password or customer text. It is not for customer use.
The pilot API is not configured. Sharing is disabled.
Synthetic test link
Separate synthetic decryption key
A synthetic share link was opened. Its fragment has been removed from the address bar. Enter the separately supplied synthetic key and explicitly reveal to test the API.
The server contract uses a fixed synthetic marker and a simulated verification transition. It does not authenticate a recipient or support real secrets. Link identifiers appear only in the URL fragment; the decryption key is separate and is never sent to the API. Browser history, extensions, screenshots, and copied links still require care.
Walk through a local-only demo
This walkthrough uses a fixed synthetic marker, browser cryptography, and in-memory mock storage. It does not accept your password, call a server, or create a usable share link.
No demo data created.
Simulation only. This example.test URL is deliberately non-routable and will not work outside this walkthrough.
Simulated link
Separate demo key
The mock verification and one-use consumption happen only in this page's memory. This demonstrates the browser sequence, not a backend, recipient identity check, durable one-time guarantee, or security review.
01ENGINEER
Create a short-lived share
After confirming the customer and recipient, the engineer would enter a secret into a protected form and choose a short expiry. The recipient and a separate contact method would be confirmed before creating a link.
02CUSTOMER
Reveal once, intentionally
The recipient would open the link and choose to reveal the secret. A normal page preview should not consume it. The link should then expire by time and after a successful reveal.
03BOUNDARIES
Keep the channel split
Send the link and the secret's decryption key through separate channels. Sending both in one email defeats much of the protection. Never use a share link to bypass the customer's approved credential process.
What must be in place before activation
Encrypt the secret in the browser; send only ciphertext to a narrowly scoped server endpoint. Keep the decryption key out of the request and server logs.
Use unguessable share identifiers, strict size limits, expiry, rate limits and an atomic one-time reveal so two concurrent requests cannot both succeed.
Do not consume a share on a plain page load. Require an explicit reveal action; this reduces accidental email-preview consumption but cannot guarantee that every security scanner behaves safely.
Exclude secrets, keys, URLs and recipient details from analytics, error reports, referrers and application logs. Use no third-party scripts on reveal pages.
Define hosting, data region, retention, deletion, abuse response, availability, privacy notice and commercial terms before storing any real secret.
A one-time link is not multi-factor authentication by itself. Do not send a password and its reveal link through the same channel. Follow the customer's approved password manager or access-provisioning policy whenever one exists.
Local generator · sharing preview only
The generator creates a password in this browser, but the page has no secret-sharing API, database, encrypted store or one-time link. This generator is not a credential-delivery channel. Do not treat the proposed sharing workflow as security-tested or use the preview to handle real customer secrets.
