SecretWolf
Get passwords out of tickets, emails and Teams chats
Send password resets and new-starter credentials as one-time links, collect admin logins from clients through a branded request, and keep a record of every handover — alongside the tools your techs already use.
Where credentials end up today
A password pasted into a ticket lives in the PSA for as long as the ticket does. Credentials sent over Teams or email get forwarded, searched and backed up. At onboarding, clients email domain, registrar and Microsoft 365 admin logins in plain text.
And at offboarding, nobody can say for certain what was shared with whom.
How it works
Two flows: sending a credential, and collecting one.
Sending
- Create the secret. Type or generate the password, or use the Login credentials template.
- Require verification. On Business, nominate the recipient's email so a one-time code is needed before it opens.
- Paste the link anywhere. Drop it into the ticket or an email. The secret itself is in neither.
- Viewed once, logged. It opens once and is deleted. The send, the verification and the view are logged.
Collecting
- Send a request. At onboarding, send the client a branded request link for the admin logins you need.
- The client fills it in. No account and nothing to install.
- It comes back to whoever asked. The tech who sent the request is emailed a link that opens once.
- Opened once, logged. Opening it deletes it, and the request, the submission and the view are on the record.
Why not a free link tool?
Free one-time link tools are fine for the odd password. A service desk usually needs more: a record of who opened which credential and when, a check that it was the right person, and one workspace for the whole team. SecretWolf includes the audit trail from the Team plan at £12/month, and recipient verification on Business.
SecretWolf vs Onetime Secret · SecretWolf vs Privnote · Is it safe to email passwords?
Where MSPs use it
-
Helpdesk password resets
Send a temporary password the right end user can open once, and nobody else can.
-
New starter credentials
Send a new starter's first login as a link that opens once, not as a line in their manager's inbox.
-
Client onboarding
Collect domain, registrar and Microsoft 365 admin logins through one branded request.
-
Client offboarding and handover
Hand credentials back at the end of a contract, with a record of what was returned.
-
Wi-Fi and shared mailbox passwords
Share a password a whole office needs with a link that allows a set number of views, then expires.
-
Sending API keys
Pass a key or token to a developer without it living in Slack or a ticket.
Built for a service desk
What a service desk gets, and the plan each feature starts on.
Safe to paste into a ticket
Only the link goes in the ticket, never the secret — and once it's opened or expires, the link leads nowhere.
Recipient verification
BusinessNominate the recipient's email and a six-digit code is sent to it before the secret reveals. A forwarded link is no use without that inbox.
Halo PSA integration (beta)
BusinessPost the link and its outcome — viewed, verified, expired — onto the Halo ticket as a note, and raise request links from the ticket. The API and signed webhooks cover any other stack.
An audit trail
TeamWho sent what to whom, whether it was verified, and when and from which IP address it was opened — metadata only. CSV export and retention settings on Business.
Your MSP's brand
TeamClients and their staff see your logo and colours on the secret page, the request form and the emails they receive — less "is this phishing?" and fewer support calls.
One workspace for the whole desk
TeamUp to 5 techs on Team and 15 on Business share one brand and one record, so the history stays when someone leaves.
Questions we hear
Do end users need an account?
No. They open the link in a browser — nothing to install and no account. Clients filling in a request link don't need one either.
What happens if a link is forwarded?
With recipient verification on (Business), the link won't open without a code sent to the address you nominated, so it's useless to anyone without that inbox. Without it, whoever opens the link first sees the secret once and it's then deleted — and the view is logged with its time and IP address.
Can multiple techs use one account?
Each tech gets their own login in one shared workspace: up to 5 on Team and 15 on Business. Requests and the audit trail belong to the workspace, not to one person.
Is there an audit trail?
Yes, from the Team plan. It records sends, requests, verifications, views, expiries and revocations with timestamps and the viewer's IP address — metadata only, never the secret. Business adds CSV export and retention settings.
Can we brand it?
Yes, from Team: your logo, colours and name on secret pages, request forms and the emails clients receive — on your own SecretWolf subdomain, or on Business your own domain, such as secrets.yourmsp.co.uk.
Is there an API?
Yes, on Business. With an API key you can create secrets and requests, check a secret's status and query the audit log, and HMAC-signed webhooks tell you when a secret is viewed or expires, or a request is fulfilled.
Explore more ways to use SecretWolf
The same verified delivery, framed for the other handovers an MSP makes.
Or see them all: Who it's for.
Deliver your next admin credential with proof
Start free with one-time secrets. Branding and the audit trail start on Team at £12/month; recipient verification, Halo PSA (beta) and the API on Business at £29/month, excluding VAT.
Start free