How to send a password securely to another device

Stop emailing passwords to yourself. Send a password, Wi-Fi key or API token to another device end-to-end encrypted, view it once, and let it self-destruct.

Most passwords that travel between devices travel badly: emailed to yourself, pasted into a chat, typed into a notes app that syncs to the cloud. Each of those leaves a readable copy behind, often for years, in places you don't control.

When you need a password, Wi-Fi key, recovery code or API token on another device, the copy should be encrypted on the way, readable only by the device it's meant for, and gone once it's been used. That's what Twinpad's Secrets are for.

How to send a password to another device

1. Open twinpad.me on the device that has the password and click Create session.
2. Connect the other device by scanning the QR code, or open the link on it.
3. In the Secrets panel, enter a label (for example "Office Wi-Fi") and the password. Tick One-time if it should only be readable once.
4. On the other device, open the secret and copy it. A one-time secret is deleted from the server the moment it's opened, and you get a notification on the sending device.
5. Destroy the session from the menu when you're done. Everything in it is deleted immediately.

What makes this safer than email or chat

• End-to-end encrypted. The secret is encrypted with AES-256-GCM in your browser. The server stores only ciphertext and never has the key.
• Masked on screen. Values show as dots until you reveal them, so they don't leak to someone looking over your shoulder or a screen share.
• Clipboard is wiped. When you copy a secret, Twinpad tries to clear the clipboard again after 30 seconds, so the password doesn't linger there. Some browsers only allow this while the tab is in focus.
• One-time secrets burn after reading. The server deletes them as soon as another device claims them. If someone else had opened it first, you'd know: the secret would be gone and the sender sees who opened it.
• Nothing outlives the session. Sessions expire after 15 minutes to 24 hours, and you can destroy them at any time.

Lock the room once your devices are in

Anyone who has the session link or the room code and password can join. Once all your devices are connected, click the lock icon: no new device can join, even with the right password. Twinpad also shows every failed join attempt in the room and locks it automatically after 25 wrong passwords.

Sending a password to another person

Twinpad is built for your own devices, but it works for handing a credential to a colleague too:

• Send them the link over a channel you trust, ideally not the same one you'd have used for the password itself.
• Use a one-time secret, so it's gone as soon as they've read it.
• Lock the room after they join, and destroy the session once they confirm they have it.

The link contains the decryption key in its # fragment, which browsers never send to the server. Whoever has the full link can read the session, so treat the link itself like the password.

Frequently asked questions

Can Twinpad read my passwords?

No. The key is derived from the session password in your browser and never leaves it. The server only receives encrypted data. Here's exactly how it works, including its limits.

Is this a password manager?

No. A password manager stores credentials long-term. Twinpad is for moving one from A to B and then forgetting it. Use both: keep passwords in your manager, use Twinpad to get one onto a device where the manager isn't set up.

What if I send it to the wrong session?

Delete the secret from the list, or destroy the session. Both remove it from the server and from every connected device.

Last updated October 25, 2026