How to Send an SSH Key Securely

An SSH private key is one of the highest-value secrets you can hold. Whoever has it can authenticate as you to every server that trusts the matching public key. The strong preference is always to have each person generate their own key pair and simply send you their public key, which is not sensitive. But there are real cases where a private key or its passphrase genuinely has to move between people: a shared deploy key, a contractor picking up an existing automation account, or an emergency handover. When that happens, the transfer method matters enormously.

Prefer public keys, but when you must send a private key

Emailing a key file, dropping it in a chat, or pasting it into a shared document are all poor choices. Key material sitting in an inbox or a message archive is a standing liability that can be exfiltrated long after the task is done. If a private key must travel, it should travel encrypted, be viewable once, and then vanish.

A one-time link does exactly this. The key is encrypted in your browser with AES-256-GCM before anything is sent, the encryption key lives only in the URL fragment (which browsers never transmit to servers), and the ciphertext is permanently deleted after the recipient opens it once.

A safe handover workflow

1. Paste the private key file contents (or the passphrase) into Burn the Secret. File attachments are also supported if you prefer to attach the key file.
2. Add a passphrase to the link itself and set a short expiry.
3. Send the link over one channel and the link passphrase over a separate one, such as a phone call.
4. Ask the recipient to confirm retrieval, then verify the link has already been consumed.
5. Where possible, rotate the key afterward so the transferred copy has a limited useful life.

Handling the key passphrase separately

A passphrase-protected key is safer to move because the file alone is not enough to use it. Send the encrypted key file through one one-time link and the passphrase through a second, independent one. Splitting the two across separate links and channels means a single intercepted message never yields a usable key.

Need to hand off a key right now? Create a secure link on Burn the Secret.