Let Your AI Agent Send You Secrets as One-Time Links
When an AI agent creates or retrieves a password, API key or file for you, it should not paste the plaintext into chat. It should encrypt the secret on its own machine with the SnapPwd CLI and send you only a one-time link. You open the link once, the secret is deleted, and SnapPwd's server only ever stores ciphertext.
By the SnapPwd team · Updated
What goes wrong when an agent pastes a credential into chat?
Agents now create accounts, generate API keys, rotate passwords and fetch credentials from vaults. The easy way to hand you the result is to print it in the conversation. Once it is there, it:
- stays in the agent's chat history for as long as that history is kept
- can sync to other devices where you are signed in to the agent
- is retained under the agent provider's data policy, not yours
- can be read again by the agent, or by anyone who later gets into the account
The same problem with human-to-human chat is covered in sharing secrets in Slack, Discord and Telegram.
How does an agent hand off a secret with SnapPwd?
Any agent that can run a shell command can do this with the SnapPwd CLI, with nothing to install first:
# a text secret (expires after 1 hour by default) npx -y @snappwd/cli put "<secret>" # a file such as a .env or key file (expires after 24 hours by default) npx -y @snappwd/cli put-file ./credentials.env # a shorter lifetime, in seconds npx -y @snappwd/cli put "<secret>" --expiration 600
The CLI prints a link such as https://snappwd.io/g/sps-…#…. The agent sends you that link and nothing else.
- 01
The agent encrypts the secret on its own machine
It runs the SnapPwd CLI, which generates a random key and encrypts the text or file locally with AES-GCM.
- 02
Only ciphertext is uploaded
The key never goes to the API. For files, the original filename and content type are stored unencrypted next to the ciphertext.
- 03
The agent sends you the link, not the secret
The printed link carries the key after the #. The agent posts that link in chat and never repeats the plaintext.
- 04
You open it once
Your browser decrypts it after you click reveal. The server deletes the secret as it returns it, so the link stops working.
put takes the secret as a command-line argument, so on a shared machine it can show up in the process list or shell history while the command runs. Where that matters, have the agent write the credential to a file and use put-file. The agent should not retrieve the new link to verify it: clicking Reveal or running get consumes it. Leave retrieval to the intended recipient.
How do I set this up in Claude Code, Codex, Cursor or another coding agent?
Install the open-source snappwd-share skill with the Skills CLI, which asks which agent to install it for. Add --global to make it available in every project.
npx skills@latest add https://github.com/SnapPwd/snappwd-skill/tree/main/skill --skill snappwd-share
On OpenClaw, install it from ClawHub:
npx clawhub@latest install snappwd-share
The skill tells the agent to return the complete link, not to echo the plaintext, and not to open links it has just created. If you would rather not install a skill, add a rule to your agent instructions file (for example AGENTS.md or CLAUDE.md):
When you need to give me a password, token or key, run npx -y @snappwd/cli put "<secret>" (or put-file <path> for files) and send me only the link it prints. Never print the secret itself.
For agents that keep long-lived API keys, see how to handle OpenClaw credentials and managing secrets in agentic AI systems.
What about personal agents like Muse, Dots and Instinct?
Personal agents already have their own way to take your passwords without putting them in the model's context. As reported by the vendors and the press as of October 2026:
| Agent | How it takes your credentials | Sources |
|---|---|---|
| Meta Muse | A credential service outside the agent's runtime holds passwords and tokens. The agent works with stand-ins, and a component called Sentinel swaps in the real values as each request leaves the VM, so the model never sees them. | |
| OpenAI Dots | Dots sign in to supported websites with saved passwords that are not exposed to the model, and sensitive tasks such as changing a password always stay with you. | |
| Instinct | Logins go into Instinct's own Vault. A 1Password integration that brokers credentials is rolling out to early-access users; no technical spec for it has been published. |
Don't use SnapPwd to give these agents your passwords. If the agent opens a SnapPwd link, the plaintext lands in the model's context, which is exactly what their own sign-in paths are built to avoid. Use the agent's own credential flow instead.
SnapPwd fits the other direction: when the agent has to pass a credential to another person. Instinct can now join group chats, including with friends who have no Instinct account (TechCrunch, Oct 5, 2026), and Dots work in Slack and Teams (DataCamp). If someone in that chat needs a shared Wi-Fi password or a guest login, a one-time link is better than text that the whole group, and the agent, keeps.
None of these agents integrates with SnapPwd, and we have not tested whether any of them can run the CLI or fill in the web form. That depends on the tools each vendor gives its agent. If yours can't, create the link yourself on snappwd.io and send it, rather than asking the agent to relay the password.
Is it safe to paste a password into a chat an agent reads?
No. If an agent is a member of a group chat or a Slack channel, everything posted there is input to that agent. A password pasted into the channel is now in the agent's context as well as in the channel history.
Sending a SnapPwd link instead keeps the plaintext out of the channel, with one caveat. The reveal page decrypts only after a click, so a link preview or a plain fetch of the page does not use it up (see do link scanners burn one-time links?). An agent that drives a real browser could still open the link and click reveal before the person it was meant for.
When that is a risk, choose Send key separately on snappwd.io. You get a link without the key and the key on its own: post the link in the channel and send the key to the recipient through a different channel, such as a direct message the agent is not part of.
What doesn't a one-time link protect against?
- The agent itself. It saw the secret when it created or fetched it. The link protects the handoff, not the agent's own context or logs.
- Whoever opens the link first. Anyone with the complete link, including the part after the #, can open it once. If you open a link and it has already been viewed, treat the credential as exposed and rotate it.
- What happens after you open it. Store the credential in a password manager or secrets manager. SnapPwd is for handoff, not storage.
We make SnapPwd, so weigh this page accordingly. The security model is described in how SnapPwd encryption works, and the CLI's behaviour in the CLI documentation.
AI agent secret handoff FAQ
Why shouldn't an AI agent paste a password into chat?
A pasted password stays in the conversation. It is kept in the agent's chat history, can sync to your other devices, and is retained under the agent provider's data policy. A one-time link can be opened once, then the secret is deleted from SnapPwd and the link stops working.
Can SnapPwd's server read the secret my agent sends?
No. The SnapPwd CLI encrypts the secret on the agent's machine and puts the decryption key in the link's # fragment, which is never sent to the API. The server stores ciphertext. For files, the filename and content type are stored unencrypted.
Should I send my passwords to Muse, Dots or Instinct with SnapPwd?
No. Each of these agents has its own way to take your password without putting it in the model's context. If the agent opened a SnapPwd link, the plaintext would land in its context. SnapPwd fits when the agent has to hand a credential to another person.
Can an agent in a group chat use up a SnapPwd link?
It can if it opens the link in a real browser and clicks reveal. Fetching the page alone does not decrypt or delete the secret. If an agent with a browser reads the chat, use the web app's Send key separately option and send the key through a different channel.
Does SnapPwd integrate with Claude Code, Codex, Cursor or personal agents?
There is no native integration with any agent. Agents with a shell can run the open-source SnapPwd CLI, and agents that load skills can install the open-source snappwd-share skill, which tells them how to create links and not to open the links they create.
Give your agent a safer way to hand you secrets
One command, no account, and the secret is encrypted before it leaves the agent's machine.