Password manager, vault, or one-time link?

Password managers: recurring human access

A team password manager fits credentials that named people use repeatedly. It supports groups, revocation, autofill, and audit history. Prefer an individual account over sharing where the target system allows it; store shared passwords only when the application cannot provide separate identities.

Secret managers: applications and automation

A cloud or infrastructure secret manager is designed for workloads. Applications retrieve values through machine identity, policies, and short-lived sessions. This reduces secrets embedded in source, images, and deployment configuration. Rotation and availability requirements are usually stronger than for a human handoff.

One-time links: exceptional delivery

A one-time link can reduce long-term message retention when sending an initial password, recovery code, or bootstrap value to someone outside the normal vault. It is a delivery mechanism, not an ongoing access-control system. The recipient still needs to move the value into an appropriate manager or replace it after use.

Use the decision questions

• Can the target issue an individual identity instead?
• Is the consumer a person or a workload?
• Will access recur?
• Must access be audited or approved?
• Can the credential be short-lived?
• How quickly can it be revoked?
• Does the recipient belong to your organization?

A practical hierarchy

Start with federated individual identity. For machines, prefer workload identity and short-lived tokens. Use a governed password or secret manager when a persistent secret remains necessary. Reserve one-time delivery for bootstrap and exceptional handoffs, then rotate or store the received value appropriately.

Sources and review basis

This guide is maintained as defensive-security education. The editorial team reviews its recommendations against current implementation experience and these authoritative references:

• OWASP Secrets Management Cheat Sheet
• OWASP Cryptographic Storage Cheat Sheet