Ask for a secret
Create a link, send it to the person who has the password. They encrypt it in their browser and send you back a link that only this browser can open.
Shown to the person you send the link to. Don't put anything secret here.
Request link ready. Send it by email or chat. It contains no secret, only a lock that this browser holds the key to.
Check words:
If you're on a call, make sure they see the same words.
Waiting for replies
No open requests.
How this works
Each request creates a fresh key pair in this browser. The private key is stored so that even scripts on this page can't read it out, and it never leaves this device. The request link carries only the public key.
The sender's browser encrypts their secret to that public key, so the reply link is unreadable anywhere else. Both of you see the same check words, made from the public key; if they match, the link wasn't swapped on the way. When you open the reply here, the key is destroyed. Reply links work once, and unanswered requests expire after 7 days.
Open replies in this same browser and profile. Clearing site data or using a private window will lose your keys.
Send a secret securely
Your secret is encrypted on this device before anything else happens. Nothing is uploaded; you'll get a link to send back, and only the person who asked can open it. Only continue if you know who sent you this link.
Check words:
If you're on a call, make sure they see the same words.
Include the username, password and anything else they need.
Encrypted. Send this link back to the person who asked. It only opens in their browser, and only once.
You can close this page now. Your secret wasn't stored anywhere.
Your secret
The key for this request has been destroyed, so this reply link can't be opened again. Save the secret to your password manager now.