Share a password securely without leaving a copy behind

The problem

Someone needs a credential from you right now: the Wi-Fi password for a contractor, the staging database login for a new developer, an API key for a vendor, a recovery code for a family member. The fastest route is the chat app that is already open. It takes three seconds and creates a permanent record of the secret on both devices, on the provider's servers, and in whatever cloud backups either of you have switched on.

Most credential leaks are not sophisticated. They are an old Slack export, a shared laptop, a mailbox that was phished a year later. The secret was still sitting there.

Why ordinary tools leak

• Slack and Teams keep every message on the vendor's servers, searchable by admins and included in exports. A password sent in 2023 is still there.
• Email is stored on both mail servers indefinitely, often unencrypted at rest, and mailboxes are the most commonly phished asset there is.
• WhatsApp and iMessage are end-to-end encrypted in transit, but the message sits in both phones' history and typically in cloud backups that are not end-to-end encrypted by default.
• SMS is plaintext, logged by carriers, and shown on lock screens.
• Clipboard sync and notifications add more copies: Universal Clipboard, Windows Clipboard History, lock-screen previews, push notification relays.

For a fuller map of where copies end up, and how the alternatives compare, see how to share a password without leaving a copy behind.

How Btwinus fits

Btwinus is a single web page, no account, no install. When you start a chat, your browser generates an encrypted invite link and a passphrase. The link carries a WebRTC handshake encrypted with AES-256-GCM, with the key derived from the passphrase by PBKDF2 (100,000 iterations), stored in the URL fragment, which browsers never send to any server. When the other person opens the link and enters the passphrase, your two browsers connect directly and the password you type travels straight to their screen. No server relays it, no history is written, and closing the tab destroys the session.

The two-channel split is the point. The link goes through one channel and the passphrase through another. An attacker who has your Slack has an unreadable blob. An attacker who overheard the passphrase has nothing to use it on.

Step by step for sending a credential

1. Start a chat. Open btwinus.com and click Start a new chat. You get a link and a passphrase.
2. Send the link through the usual channel. Slack, email, WhatsApp, whichever you already use with this person. It is safe on its own.
3. Send the passphrase a different way. Say it on a call, text it if the link went by email, or say it across the desk. Never put both in the same thread.
4. Get their reply link. They open the link, enter the passphrase, and a reply link is copied to their clipboard. They send it back through the first channel.
5. Paste, verify, send the secret. Paste the reply link. Compare the short authentication string on both screens to confirm no one is in the middle. Then type the password, wait for them to confirm they have saved it in their password manager, and close the tab.

For someone standing next to you, show the link as a QR code and say the passphrase out loud. That is the lowest-friction path of all.

Honest limitations

• Both people must be online at once. There is no "leave it for them to pick up later". If you need asynchronous delivery, a password manager's one-time share link is a better fit.
• One to one only. Sending a shared credential to a whole team means repeating the process, or using a shared vault, which is the right tool for that anyway.
• The recipient's copy is now their responsibility. Btwinus stops the transfer from leaving a trail. It cannot control whether they paste it into a text file.
• IP addresses are mutually visible. As with any WebRTC connection, each browser sees the other's IP. Btwinus sees neither. Rarely relevant for a coworker, worth knowing for a stranger.
• Not a replacement for a password manager. Btwinus is the delivery, not the storage. Long-lived shared credentials belong in a shared vault where they can be rotated.
• No history. Once the tab closes, neither of you can scroll back. Make sure the recipient has saved the secret before you close.
• Seed phrases. Even with a tool like this, the safest way to move a crypto seed phrase is on paper, in person. Do not send it digitally unless you truly have no alternative.

Btwinus is free and open source, so you can read exactly what happens to the secret you type.