TTL Secrets
Create one-time, expiring secret shares with a private link, a separate passphrase, status tracking, and automatic cleanup.
TTL secrets are one-time, time-limited shares for delivering a sensitive value to a person. SikkerKey encrypts the value, creates a private link and a separate six-word passphrase, and closes the share after its first reveal attempt or when its lifetime ends.
The link and passphrase are shown to the creator once. Copy both before closing the creation result, then deliver them to the intended recipient.
#How a TTL secret works
You create the TTL secret inside a project, paste a value or ask SikkerKey to generate one, and choose a lifetime.
SikkerKey encrypts the value and returns a private link plus a six-word passphrase.
You send the link and passphrase to the recipient, preferably through separate communication channels.
The recipient opens the link in a browser and submits the passphrase.
A correct passphrase reveals the value once. A wrong passphrase closes the share immediately.
The share also closes automatically when its selected lifetime ends.
Opening the link displays the reveal page. The one-time attempt is consumed when the recipient submits the passphrase.
#Create a TTL secret
Open the project and select Secrets.
Select the plus button, then choose TTL secret.
Enter a name that will help your team recognize the handoff.
Paste the value you want to share, or enable Generate a random value.
Choose the self-destruct lifetime.
Select Create secret.
Copy the link and passphrase from the Result step before selecting Done.
Names can contain up to 256 characters. Pasted values can contain up to 100 KB of text.
#Generate the shared value
Enable Generate a random value when the recipient needs a newly created password, token, or identifier. You can choose:
Random: a value from 8 to 128 characters.
Character types: uppercase letters, lowercase letters, digits, and symbols.
UUID: a generated UUID with a fixed format.
The preview shows the selected format. SikkerKey creates the actual value when you create the TTL secret and delivers it through the one-time share.
#Choose the lifetime
A TTL secret can remain available from 1 minute to 24 hours. The creation form starts at 5 minutes, which is suitable for an active handoff.
Situation | Suggested lifetime |
|---|---|
Recipient is ready to open it | 5 minutes |
Recipient needs time to switch devices or communication channels | 15–30 minutes |
Coordinated handoff across time zones | Use the shortest planned window, up to 24 hours |
Create the share when the recipient is ready. A shorter lifetime keeps the delivery window focused and makes the status easier to interpret.
#Save and deliver the result
The Result step contains two items:
Link: opens the SikkerKey recipient page.
Passphrase: six random words joined with hyphens.
Copy both immediately. Send them through separate channels when practical—for example, send the link in your work chat and the passphrase through a phone call or another trusted messaging channel.
Verify the recipient before sending either item. Anyone who holds both the active link and the correct passphrase can use the single reveal attempt.
#Recipient experience
The recipient can use a current web browser and does not need a SikkerKey account. Their flow is:
Open the link.
Confirm the six-word passphrase with the sender.
Enter the complete passphrase and select View Secret.
Copy the revealed value before closing or refreshing the page.
After a successful submission, the page displays the value with a Copy button and the share status changes to Viewed. The same link then shows Secret Not Available on future visits.
If the submitted passphrase is wrong, the page shows Secret Destroyed and the link becomes unusable. The sender can create a fresh TTL secret for another attempt.
#Understand the one-time lifecycle
Event | Result |
|---|---|
Correct passphrase submitted | The value is revealed once, the encrypted payload is cleared, and the status becomes Viewed. |
Wrong passphrase submitted | The reveal is denied, the link closes immediately, and the status becomes Destroyed. |
Lifetime ends | The link closes and the record is removed during automatic cleanup. |
Sender deletes a pending share | The link closes immediately and the status becomes Revoked until cleanup. |
Only the first passphrase submission can complete. If two attempts arrive together, SikkerKey processes one and closes the share before the other can reveal it.
#Track TTL secret status
Active TTL shares appear in the TTL Secrets section beneath the project’s main secrets table. Refresh the Secrets page to see the latest recipient status.
Status | Meaning |
|---|---|
Pending | The link is within its lifetime and waiting for a passphrase submission. |
Viewed | The correct passphrase was submitted and the value was revealed once. |
Destroyed | A wrong passphrase was submitted and the share was closed. |
Revoked | A project member deleted the pending share. |
Expired | The lifetime ended before a successful reveal. |
The table also shows the remaining lifetime and creation time. Status records are temporary and are removed automatically after the share’s original expiry time.
#Revoke a pending share
Use Delete when a recipient no longer needs the value, the delivery details were sent to the wrong person, or you want to replace the share.
Open the project’s Secrets page.
Find the share in the TTL Secrets section.
Open its action menu and select Delete.
Confirm Delete share link.
Revocation takes effect immediately. Create a new TTL secret when you need a replacement link, passphrase, value, or lifetime.
#Common handoffs
Deliver a newly generated setup password to a colleague.
Send an API token to a contractor during onboarding.
Hand a database credential to an administrator for a scheduled task.
Share a recovery or activation code during a live support session.
Transfer a sensitive configuration value during an incident.
#Troubleshooting
The result window was closed before both items were copied
Delete the pending share from the TTL Secrets section and create a replacement. Copy both items from the new Result step before closing it.
The recipient sees Secret Not Available
Check the project’s TTL Secrets status and Audit Log. A Viewed, Destroyed, Revoked, or expired share has completed its one-time lifecycle. Create a replacement when the recipient still needs the value.
The recipient entered the wrong passphrase
The share closes on that submission. Confirm the recipient and delivery channels, review the failed event and source IP address, then create and send a new TTL secret.
The recipient revealed the value but did not copy it
A successful reveal consumes the share. Create a new TTL secret and have the recipient copy the value before leaving the result page.
A pending share should be replaced
Delete it from the TTL Secrets section, then create a new share with the updated value and lifetime.