The Risk of Traditional Channels
When onboarding a new client, agencies and freelancers frequently need to exchange sensitive details like CMS logins, hosting access, and recovery codes. Sharing these credentials via email, Slack, or support tickets creates an immediate security gap.
Email, chat, and ticket systems can retain credentials in searchable histories, backups, notifications, or exports, depending on an organization’s configuration. For sensitive credentials, use a purpose-built sharing process instead of leaving them in a searchable message thread.
Secure Handoff Workflow
Instead of pasting passwords directly into chat, use a deliberate process for sharing API keys securely and distributing initial setup details:
- Inventory and Scope: Identify exactly what the client needs. Only share credentials for limited-scope accounts, not root administrative accounts.
- Use a Transmission Tool: Use Hush to create an encrypted link for the initial password or API key. Hush is designed for transmission, not long-term storage.
- Out-of-Band (OOB) Verification: Send the link via email, but if using a passphrase, send the passphrase through a separate channel (like SMS).
- Mandatory Rotation: Instruct the client to immediately log in and change the temporary password to one stored in their own password manager.
- Post-Project Cleanup: Revoke any temporary access your agency required once the project concludes.
For more details on avoiding chat log risks, see our guide on how to send passwords securely.
One-Time Secret vs. Private Room
Hush offers two distinct tools for client handoffs, each with specific product behaviors:
Hush One-Time Secrets Best for asynchronously sharing a static password, API key, or recovery code. - **Browser Encryption**: The secret is encrypted on your device before upload. - **Consumption behavior**: Normal one-time secrets are consumed after a successful read. Passphrase-protected secrets remain available until successful finalization or expiry. - **Expiry**: Secrets automatically expire if left unread.
Hush Private Rooms Best for synchronous, real-time troubleshooting or quick configuration setups (e.g., [Agencies](/use-cases/agencies) coordinating a live deployment). - **Two Participants**: The room strictly supports exactly two people. - **Both Online**: Both participants must be online; there is no offline delivery. - **Text Only**: Only text can be exchanged; no attachments or media are supported. - **15-Minute Expiry**: The room completely self-destructs 15 minutes after creation. - **No Durable History**: Refreshing the browser instantly clears the local chat history.
If you need a real-time exchange, create a Private Room instead.
Steps for the Recipient
When a client receives your Hush link, they should follow these steps: - Click the link to reveal the secret in their browser. - Immediately copy the credential into a secure password manager. - Log into the service and rotate the password or verify the API key. - Acknowledge receipt to the sender so they can verify the handoff is complete.
For more context on API key handling, see our guide to securely share API keys.
Security Checklist
Before sending any sensitive data, verify: - [ ] Is this credential scoped to the minimum required permissions? - [ ] Is the communication channel appropriate? (Avoid email for plaintext passwords). - [ ] Have I explained to the client that this link will only work once? - [ ] Is there a plan to revoke or rotate this credential later?
Important Security Limitations
While Hush prevents credentials from persisting in chat logs, it does not provide absolute security. Please review our Security Model and be aware of the following:
- Not Identity Verification: Possession of a Hush link does not prove identity. Anyone with the link (and passphrase, if set) can view the secret.
- Screenshots and Copying: Hush cannot prevent the recipient from taking screenshots or copying the revealed text.
- Compromised Devices: Malware or keystroke loggers on either the sender's or receiver's device can capture data outside of Hush's control.
- No Zero Retention Guarantees: We do not claim anonymous, untraceable, or compliance-certified zero retention across all possible infrastructure backups, though the live database entry is destroyed upon consumption.