Password managers and one-time secret links are often presented as alternatives. They aren't. A password manager is a vault: long-term storage for credentials you use again. A one-time link is a courier: it carries one secret to one person and then disappears. Most people and teams need both, and the trouble starts when one is used to do the other's job.
What a password manager is for
A password manager generates, stores and fills passwords, so you can use a long, unique one everywhere. Security agencies recommend them: CISA's mobile communications guidance says to use a password manager to store all passwords, and NIST's digital identity guidelines, SP 800-63B-4, require services to allow password managers and autofill.
For sharing, most managers offer shared vaults or collections. A team or family keeps common credentials in one place, access is granted and removed per person, and when a password changes, everyone sees the new one.
What a one-time secret link is for
A one-time link solves a narrower problem: getting a secret to someone who isn't in your vault, once. You paste the secret, it's encrypted in your browser, and the recipient gets a link that opens it and then stops working. In ProtectedShare's Secure Notes, the note is encrypted with AES-256-GCM before upload, the key travels in the link after the #, and a burn-after-reading note is deleted from the database when it's opened. Nobody needs an account on either side.
Side by side
| Password manager | One-time secret link | |
|---|---|---|
| Job | Store and fill credentials you use again | Deliver one secret, once |
| Recipient needs | Usually an account in the same manager, for shared vaults | Only a browser |
| Lifetime | Until someone deletes it | Until it's opened or expires (ProtectedShare: 30 days at most) |
| When the password changes | Everyone with access sees the new value | You send a new link |
| Taking access back | Remove them from the vault, though they may have copied it | Revoke an unopened link; after that, change the password |
| Best for | Your own accounts, team credentials, anything used repeatedly | Handoffs to people outside your vault, one-off secrets |
How the security compares
Both can be designed so the provider can't read your secrets: the encryption happens on your devices, and the provider stores ciphertext. The differences are in who can open what, and for how long.
- Who can open it. A vault item sits behind someone's account sign-in, often with multi-factor authentication. A link opens for anyone who has the whole link. That's why one-time links should be short-lived and, for important secrets, paired with a password sent another way.
- How long it exists. A vault item lives until someone deletes it, in every synced copy. A burned link's ciphertext is deleted from the server when it's opened, so there's nothing left there to breach later.
- What you can take back. You can remove someone from a shared vault, but not from their memory or their own copy. A link can be revoked only until it's opened. Either way, changing the password is the only real way to take access back.
Four questions that decide it
- Will they need it again? If so, it belongs in a password manager.
- Are they already in your password manager? Then share it there.
- Will the password change? A shared vault keeps everyone current; a link would have to be sent again.
- Do you need something from them instead? Reverse the direction and send a secret request.
If the answer to all four is no, a one-time link is the simpler tool.
Many password managers can send one-time links too
If you already use a password manager, check its sharing features before adding another tool.
- 1Password can share a copy of an item with anyone, even if they don't have a 1Password account. You choose when the link expires and whether it's available to anyone with the link or only to specific people.
- Bitwarden Send transmits text or files through temporary links. According to Bitwarden's documentation, data is encrypted on creation and decrypted only when a recipient opens the link, a Send lives for at most 31 days, and you can set a maximum access count. Recipients don't need a Bitwarden account to open a Send.
A standalone tool still earns its place when you don't use a password manager, or the person sending isn't part of your organisation; when you need a secret sent to you (secret requests encrypt the reply to a key only your inbox link holds); for .env files with a read limit (EnvShare) or for files (file drop); or when you want something you can self-host. There's a fuller comparison in ProtectedShare vs Bitwarden Send.
Setting up team sharing in a password manager
If a small team is about to start sharing credentials in a password manager, a little structure at the start saves cleanup later:
- Create shared vaults or collections by purpose, such as "Marketing accounts" or "Production break-glass," rather than one vault for everything.
- Add only the people who need each one, and review membership whenever someone joins, leaves or changes role.
- Turn on multi-factor authentication for the password manager itself, since it now guards every shared credential.
- Write down who owns each shared account, so someone is responsible for changing the password when the team changes.
When to use a password manager
- For your own accounts, all of them.
- For credentials a team uses every week, such as a shared social media login that can't have individual users.
- For anything that changes and has to stay in sync for several people.
- For recovery codes and other secrets you'll need to find again.
When to use a one-time link
- Sending a new hire their first password before they're set up in your vault. They change it at first sign-in.
- Giving a contractor a credential for a short job, with a password change when the job ends.
- Moving a secret between your own devices when they don't share a vault.
- Getting a password or key from a client or a family member: send them a secret request.
The mistakes that come from mixing them up
- Using links as storage. Creating long-lived links "so the team can always find it" turns a courier into a badly organised vault. If a link keeps needing to be re-sent, the credential belongs in a password manager.
- Exporting vault entries to share them. An exported file or a screenshot bypasses the vault's access control. Use the manager's own sharing, or a one-time link.
- Giving outsiders vault access for one password. A guest seat for someone who needs a single credential once grants more than the job requires, and it's easy to forget to remove.
A routine that uses both
- Keep every credential in your password manager.
- When someone outside the vault needs one, send it through a one-time link, from your manager or from ProtectedShare.
- Ask them to store it in their own password manager, not in a notes app or a chat.
- When the work ends, remove access and change the password.
When neither is the right tool
The best credential to share is the one you don't have to share. Prefer individual accounts, single sign-on or delegated access where a service supports them. Passkeys go further: the FIDO Alliance describes them as a password replacement that is phishing-resistant and designed so that there are no shared secrets. For machine credentials, such as API keys used by servers, use your platform's secrets manager rather than either tool.
Sources
- CISA, Mobile Communications Best Practice Guidance
- NIST, SP 800-63B-4
- 1Password Support, Securely share 1Password items with anyone
- Bitwarden Help, About Send and Receive a Send
- FIDO Alliance, Passkeys