Ten practices that matter
Use the following checklist for any password-protected share:
- Use at least 12 characters; prefer several unrelated words or a password-manager generated value.
- Never reuse the recipient's account password or another real credential as the link passphrase.
- Send the link and passphrase through different providers or verified channels.
- Do not place the passphrase in a nearby follow-up message in the same compromised mailbox.
- Choose a short expiry that still gives the recipient a realistic chance to respond.
- Verify unexpected recipient changes or urgent requests using a known contact method.
- Keep only one intended recipient per high-impact Relay.
- Avoid revealing sensitive context in the email subject or notification preview.
- Confirm receipt and rotate any reusable credential that was delivered.
- Treat an unexpected 'already opened' result as a possible incident, not a software inconvenience.
Passphrase versus Relay Code
A Relay Code is a convenient way to locate a Relay without sending the full URL. It is not equivalent to a password. Anyone who obtains the code can attempt retrieval, so a separate passphrase is still needed when knowledge of the locator should not be enough.
The passphrase should be processed in the recipient's browser and should not be logged or sent to the delivery server. That preserves the purpose of the second secret.
Design for email link scanners
Corporate email security tools often inspect URLs before a person clicks them. Services should avoid consuming sensitive content on a simple page load and should require a deliberate reveal action. Passphrase protection adds a strong boundary because the scanner does not have the separately delivered passphrase.
If your organization rewrites every URL or opens links in an isolated browser, test the workflow with non-sensitive data before relying on it during a real handoff.
Respond to an unexpected opening
One-time behavior provides a useful warning: the intended recipient cannot retrieve a Relay that someone else already consumed. Do not resend the same underlying password or token. Revoke it at the source, investigate the delivery channels, create a new scoped credential, and use a new Relay and passphrase.
The goal is not to prove exactly what happened before acting. For high-impact credentials, rapid rotation is usually cheaper than uncertainty.