Start 7-day free trial

Every feature, and how it works

What Squawk Secret does, step by step, and which plan includes it. Everything you send and receive is encrypted in the browser and erased when it’s no longer needed.

All plans

Squawks: one-time secure links

Send a password, note, or file as a link that works a set number of times and then destroys itself.

How it works

  1. Choose what you’re sending: a message, or a Login, Wi-Fi, Server, or Custom fields card that the recipient sees with masked values and Copy buttons. A strong password generator is built in, and you can attach files.
  2. Choose how many times it can be opened (up to 100) and when it expires (up to 30 days). Optionally add a passphrase, lock it to specific email addresses or networks, and ask to be told when it’s opened.
  3. Your browser encrypts it and gives you the link. Copy it, or have us email it for you.
  4. The recipient opens the link, with no account needed. When the views run out or it expires, the encrypted data is erased.

Good to know

  • Up to 10 files and 25 MB per squawk.
  • Screenshot and copy deterrents with a viewer watermark, for extra-sensitive items.
  • Every open and failed attempt is in the audit trail, with time, IP address, and outcome.

All plans

Requests

Collect passwords and files from clients, with a link they reply to.

How it works

  1. Write what you need, such as “Please send the router admin password and last month’s statement.”
  2. Choose one client (open up to 30 days) or a reusable link many people can use (up to a year and 1,000 responses), then copy the link or have us email it.
  3. Your client opens the link, with no account needed, and replies with a message and files. Their browser encrypts everything before it’s sent.
  4. You open responses in your browser and can download each one as a PDF.

Good to know

  • Your browser makes a key pair for each request. The private key stays with you and a private link you save, so we can’t read responses.

Business

Intake forms

Turn a request into a complete form, so clients give you everything you need the first time.

How it works

  1. Start from a template (banking details, W-9 information, IT inventory, new client onboarding, and more) or build your own.
  2. Add fields: text, secret, multi-line, dropdown, date, number, yes/no, file, and section headings, with format checks for routing and account numbers, EINs, SSNs, email addresses, ZIP codes, and phone numbers.
  3. Add a typed signature where you need one; the client agrees to your statement and types their name.
  4. Clients fill it in on any device, their answers are encrypted before sending, and you get a clean response you can download as a PDF.

Good to know

  • Typed signatures come with a record of who signed, when, and what they agreed to.
  • The same fields work on your Squawk Drop page.

Business

Fillable PDF forms

Have clients fill in the real PDF, and get back the completed, signed form.

How it works

  1. On a new request, choose Fillable PDF: a ready-made Form W-9, W-4, or I-9 (employee section), or upload your own fillable PDF (up to 5 MB).
  2. Your client sees the actual form in their browser and types into its boxes. Required items and formats like SSNs are checked before sending.
  3. They agree to the form’s own certification and type their name to sign.
  4. Their browser fills in the PDF, locks the fields, adds a signature record page, and encrypts it. You download the completed form.

Good to know

  • Only the right parts are fillable: for example, an I-9’s employer section stays blank for you.
  • Filling in happens on a computer or a phone; phones zoom to type.

Business

Squawk Drop: a secure page for your team

A page with your name in the address where clients can send you information and files at any time. Have up to 10, each with its own people.

How it works

  1. Choose your page’s address, title, and message, optional topics (like Billing or Tax documents), and how long items are kept (1 day to a year).
  2. Choose who can send: anyone with the link, or only approved senders (specific addresses or whole domains), who confirm their email with a code.
  3. Clients open the page, pick a topic, and send text, form answers, and files. Everything is encrypted in their browser, including file names.
  4. Your team gets a notice and opens items in the Squawk Drop inbox, marks them done, downloads files, or deletes them.
  5. Need more than one? Owners and admins can add up to 10 Squawk Drops, such as Tax documents, HR, and Billing. Each has its own page, settings, and approved senders.
  6. Under People in a Squawk Drop’s settings, choose who can open it: managers run that box, members work its items, and viewers can read and download only. Owners and admins manage every box. Add a teammate by name, or type the email of someone new to invite them to your team and the box in one step.

Good to know

  • Up to 2 GB and 20 files per submission, uploaded straight to encrypted storage.
  • Each Squawk Drop has its own private key. It stays in the browsers of the people allowed to open that box, passed from one teammate’s browser to the next, and in a recovery link you save.
  • Only people added to a Squawk Drop get its items. Removing someone stops that right away.
  • Notices go out at most once every 10 minutes, so a busy day doesn’t flood your inbox.

Business

Squawk Vault: long-term encrypted storage

A private place for the files you need to keep, 100 MB for each person, encrypted so that only you can open them.

How it works

  1. Open Squawk Vault in the menu and choose a passphrase of at least 12 characters. It never leaves your browser.
  2. Save the recovery key you are shown. It is the only way back in if you forget the passphrase, and it is shown once.
  3. Add files by choosing them or dragging them onto the page, a whole folder at a time if you like: recovery codes, license files, signed agreements, anything you need to keep. Each is encrypted in your browser before it is uploaded.
  4. Organize with folders, and folders inside folders: New folder makes one, files you add go into the folder you have open, and Move puts a file somewhere else.
  5. Unlock with your passphrase whenever you come back. Download, rename, or delete files, and search every folder by name.

Good to know

  • Each person on a Business account has their own vault of 100 MB. Files stay until you delete them.
  • Only you can open your vault. Your admins can’t, and neither can we: we store the files and even their names encrypted, and we never have your passphrase or recovery key.
  • If you forget your passphrase, the recovery key lets you set a new one. If both are lost, the files can’t be decrypted by anyone; you can erase the vault and start over.
  • If you leave your organization, your vault is erased 7 days later. Deleting your account erases it right away.

Business, in beta on request

Squawk Keeper (beta): a password keeper for your team

One place for the logins, cards, keys, and notes your team relies on, encrypted so that only the people you choose can open them.

How it works

  1. Squawk Keeper is in beta. Write to support@squawksecret.com and we turn it on for your organization, or for a few people first.
  2. Open Squawk Keeper in the menu and choose a passphrase of at least 12 characters. It can be the same one you use for Squawk Vault. Save the recovery key you are shown; it is shown once.
  3. Add entries: logins, credit and debit cards, bank accounts, API keys, servers, databases, Wi-Fi, software licenses, identity documents, PINs, and secure notes. Each kind has its own fields, and a password generator is built in.
  4. Paste an authenticator key, or the whole setup link, into a login and the six-digit code appears beside it, counting down like it does in an authenticator app.
  5. Bring your logins over from LastPass, 1Password, Bitwarden, Proton Pass, Dashlane, NordPass, KeePass, or a browser. The export is read in your browser and is never uploaded.
  6. Make a shared folder and add teammates as managers, members, or viewers. Managers choose who is in it, members add and change entries, viewers can only read.
  7. Connect the extension for Microsoft Edge with a one-time code. It fills sign-in pages from your keeper, fills a saved card into a payment form, shows an icon in the username box, and offers to save a new login as you sign in.

Good to know

  • Only you can open your personal entries. Your admins can’t, and neither can we: every entry is encrypted in your browser, and we never have your passphrase or recovery key.
  • A shared folder has its own key, with a copy sealed to each member. An admin who is not in a folder cannot read it.
  • When a folder’s manager leaves the organization, the folder is handed to another member, so it is never left without someone in charge.
  • The account owner can turn on an organization recovery key, so a shared folder is not lost if everyone who could open it has gone. It covers shared folders only, never personal entries. Everyone is told while it is on, and every use is recorded and emailed to the folder’s members.
  • Leave an entry on screen and the page blurs after a minute without activity. The extension locks itself after a time you choose.
  • If you forget your passphrase, the recovery key lets you set a new one. If both are lost, your personal entries cannot be decrypted by anyone.
  • Removing someone from a shared folder stops them opening it from then on. It does not change the passwords they have already seen, so change those yourself.
  • While it is in beta, Squawk Keeper may change, and the extension is sent to you directly rather than through the Edge Add-ons store. Keep your own copy of anything you cannot afford to lose.

Business

Secure chats

A short-lived, end-to-end encrypted conversation with clients that erases itself.

How it works

  1. Name the chat, invite up to 10 people by email, choose when it erases (1 hour, 8 hours, 24 hours, or 7 days), and optionally add a passphrase and teammates as co-hosts.
  2. Guests open their invitation on any device, with no account or app, and confirm a code sent to their email.
  3. A browser already in the chat hands them the chat’s key, sealed for their device alone, and they’re in.
  4. Send messages, masked credentials, and files. Close the chat, or let its timer run out, and it’s erased for everyone.

Good to know

  • Files up to 100 MB each.
  • Someone who already has the chat open lets new people in; with a co-host, it doesn’t depend on one person.
  • The chat’s activity log records who joined and when, never what was said.

Business

Windows desktop notifications

A small system tray app that tells you the moment something arrives.

How it works

  1. Download the app from your Profile page and run it.
  2. On your Profile, click Connect a Windows computer and paste the one-time code into the app.
  3. The app checks for news every minute and shows a notification: a new Squawk Drop item, a squawk sent to you, a response to your request, a squawk being opened, or a chat message.

Good to know

  • Notifications show who and when, never the secret itself.
  • Disconnect a computer anytime from your Profile.

All plans

Your notification settings

Choose which notices you get by email and, on Business, in the Windows app.

How it works

  1. Click your name at the bottom of the sidebar to open your Profile.
  2. For each kind of notice, turn email on or off (and, on Business, the Windows app). Changes save right away.

Good to know

  • Security emails, like password resets, always arrive. Alerts about sign-ins from a new device are on unless you turn them off under Security in Settings.

Business

Teams, sign-in, and oversight

Put your whole company on one account, with the controls an admin needs.

How it works

  1. Invite teammates by email and give them admin or member roles. Removing someone signs them out everywhere, instantly.
  2. Require two-step verification for everyone, and turn on single sign-on with Microsoft 365, Google Workspace, or Okta after verifying your email domain.
  3. Set team policies: the longest a squawk or request can last, allowed attachment types, and which email domains squawks can be sent to.
  4. Add your logo to the links and emails your team sends, and review or export the audit trail as CSV.

Good to know

  • Business is $49 per month for up to 5 users, then $8 per additional user.

Business

API and webhooks

Send squawks from your own systems, and hear back when things happen.

How it works

  1. Create an API key, optionally limited to your networks. Keys are stored only as a one-way hash.
  2. Have your onboarding system (an Active Directory script, Power Automate, Okta Workflows, Zapier, or your HR system) call the API to create a squawk, such as a new employee’s first-day password.
  3. Add a webhook to be told when a squawk is opened, expires, or is destroyed, or when a Squawk Drop item arrives.
  4. Pull Squawk Drop items and files into your document or practice management system. They stay end-to-end encrypted through the API, and your server decrypts them with the Squawk Drop’s recovery link. Mark items done, erase them, and manage approved senders the same way.

Good to know

  • Squawks created through the API are encrypted on our servers, because your system sends us the contents to protect.
  • Full details are in the API documentation.

Read the API documentation

Business

SIEM integration

Send your security events to Splunk, Microsoft Sentinel, Datadog, Elastic, or any SIEM.

How it works

  1. Push: on the API page, enter your Splunk HTTP Event Collector address and token, or any HTTPS endpoint that accepts JSON, and send a test event.
  2. Events arrive within seconds: sign-ins and failed attempts, two-step and account changes, team, policy, API key, and billing changes, and squawk, request, Squawk Drop, and chat activity.
  3. Or pull: create an API key with the Read security events permission and have your SIEM poll the events API.

Good to know

  • Each event has a category and a success or failure outcome, plus who, when, and from which IP address. Never the contents of anything sent or received.
  • If your collector is down, delivery retries and then catches up, so nothing is lost. The events API holds 12 months of history.
  • Push needs a collector reachable over the internet at an https:// domain name; for one on a private network, use the events API.

Coming soon

The Healthcare plan (HIPAA-ready)

Everything in Business, with a Business Associate Agreement and HIPAA safeguards switched on and locked in.

How it works

  1. Choose the Healthcare plan. Your owner signs our Business Associate Agreement in the app; until then, don’t send patient information.
  2. Safeguards are enforced for everyone: two-step verification, sign-out after 15 minutes idle, every link locked to its recipient and lasting at most 7 days, and no AI assistant.
  3. Access records are kept six years, as HIPAA documentation requires; the contents are still erased once opened or expired. Notes, subjects, and instructions that travel by ordinary email are checked for identifiers.

Good to know

  • Patient information goes only in the end-to-end encrypted parts of Squawk Secret: messages, files, requests, forms, and chats.
  • A Business Associate Agreement covers Squawk Secret; HIPAA compliance also depends on your own risk analysis, policies, and training.

Business

Compliance evidence packs

A monthly PDF for your auditor, examiner, or insurer: how Squawk Secret supports each requirement, with your own activity as evidence.

How it works

  1. Admins open Compliance, choose frameworks and a month, and download the pack.
  2. For each requirement: what it asks (with the citation), how Squawk Secret supports it, your evidence for the month (how much was encrypted end to end, locked to recipients, and erased; two-step verification coverage; sign-ins and blocked attempts), and what’s still your responsibility.
  3. An appendix of ready-to-use policy text for your written security program, such as the WISP tax professionals must keep, with your firm’s name filled in.

Good to know

  • Covers the FTC Safeguards Rule, IRS Publications 4557 and 5708, Massachusetts 201 CMR 17, ABA Model Rule 1.6(c) and Formal Opinion 477R, NYDFS Part 500, PCI DSS 4.0.1, the HIPAA Security Rule, CMMC Level 1 (FAR 52.204-21), and NIST SP 800-171 / CMMC Level 2.
  • It documents support; it doesn’t make you compliant and isn’t legal advice. HIPAA use requires a Business Associate Agreement first, and Squawk Secret doesn’t meet NIST’s FIPS-validated cryptography requirement; the pack says so.

Business

Certified delivery

Like certified mail: a signed Certificate of Delivery proving what you sent, to whom, and exactly when it was opened.

How it works

  1. When sending, check Certified delivery. Each attached file’s SHA-256 fingerprint is taken in your browser, before it’s encrypted.
  2. After it’s opened, choose Certificate on it in Audit to download a signed PDF: who sent it, each file’s name and fingerprint, the protections used, which email was confirmed with a code, and every attempt to open it with time, IP address, and browser.
  3. Anyone you give it to can check it at the link printed on it, which shows the facts we certified. A changed PDF won’t match, and the Ed25519 signature can also be checked with our published public key.

Good to know

  • It never includes the contents, which we can’t read. Text isn’t fingerprinted, because a short secret’s fingerprint could be guessed; files are.
  • Anyone holding the original file can confirm it’s the one delivered by computing its SHA-256 (Get-FileHash on Windows, shasum -a 256 on a Mac) and comparing.

Business

Two-person secrets

For the most sensitive credentials: require a teammate’s approval before it opens, or make two people open it together.

How it works

  1. Require approval: name a teammate as the approver and say why. The link won’t open until they approve it on their Approvals page; if they deny it, it’s destroyed. You’re told either way.
  2. Two people together: enter both people’s email addresses and you get one link for each, each holding half of the key. Send them separately, ideally by different routes.
  3. Each person confirms their email. The first to arrive waits; the other adds their half, sent encrypted straight to the first person’s screen, and both screens show the same match code. Then it opens on the first person’s screen.

Good to know

  • Either half alone reveals nothing, not even to us: we never hold both halves, which is why we don’t email two-person links for you. Auditors call this split knowledge and dual control.
  • Approvers must be members of your team, and nobody can approve their own. Everything is recorded in Audit and the SIEM feed.

Business

Squawk Back

Help desk identity checks: confirm who you’re talking to before a password reset, or prove to them that you’re really IT.

How it works

  1. Open Squawk Back and enter the person’s email or mobile number from your own records, never one the caller gives you.
  2. Verify them: they get a 6-digit code (by email, with a “Yes, it’s me” button, or by text). They squawk it back to you or tap Yes, and your screen shows Verified. If they choose No, your screen warns that someone may be impersonating them.
  3. Or prove it’s you: they get a code from your organization, and you read the same code to them, so they know the call is really from IT.

Good to know

  • Codes expire in 10 minutes and allow 5 tries. Opening the email link confirms nothing by itself, so email security scanners can’t confirm anyone.
  • Every check is recorded in Audit and the SIEM feed, with the contact masked. Text messages use Twilio; the “prove it’s us” code by text needs a Twilio messaging service.
  • Start checks from your ticketing system or scripts with the API, and get results by webhook (identity.verified, identity.denied, identity.failed).

Business

Squawk Guard

Catches passwords, card numbers, Social Security numbers, and keys before they’re sent by email, and warns in Teams.

How it works

  1. In Outlook, when you click Send, Squawk Guard checks the email on your computer. If it finds something sensitive, Outlook pauses.
  2. Choose Send securely: the Squawk Secret panel replaces each item with a one-time encrypted link, including copies in quoted earlier messages. Or send anyway.
  3. In Teams channels and group chats, if a message contains something sensitive, Squawk Secret replies with a warning and a button to send it securely instead.

Good to know

  • It looks for passwords, credit card numbers (checked with the Luhn test), Social Security numbers and ITINs (real numbering rules), EINs, bank routing and account numbers (ABA checksum), IBANs (check digits) and SWIFT or BIC codes, API keys and tokens, private keys, connection strings, and labeled passport and driver’s license numbers.
  • Outlook’s check runs inside Outlook; the email isn’t sent to us. In Teams, messages are checked on our server in memory and never stored; the warning never repeats what it found.
  • Teams doesn’t let apps check messages before they’re sent, so the warning comes right after. Microsoft limits it to standard channels and group chats. Part of the Outlook add-in and Teams app.

All plans

Don’t open until

Send a link now that can’t be opened until the date and time you choose.

How it works

  1. When sending, set “Don’t open until”: a new hire’s first morning, the moment an announcement is public, or a bid deadline.
  2. Share the link right away. Until then, it shows a countdown in the recipient’s own time zone, and nothing is used up.
  3. At that time it opens normally. Its expiry counts from then, so “expires in 3 days” means 3 days after it opens.

Good to know

  • Up to 90 days ahead. Works from the website, Outlook, Teams, the API (opens_at), and the Send-InitialCredentials script (-AvailableFrom).
  • Emails we send for it say when it opens. Scheduled links show as “scheduled” in Audit and can be destroyed before they open.
  • The time lock is enforced by our servers, which don’t release the encrypted content until then.

Business

Microsoft Teams app

Send passwords from any Teams chat as one-time links, instead of leaving them in chat history.

How it works

  1. An admin installs it once for your organization: one package adds both the Teams app and the Outlook add-in (the steps are on the Microsoft 365 apps page in Squawk Secret).
  2. In a chat or channel, choose Squawk Secret in the message box, then Send a secret or Request a password or file. Sign in once.
  3. The secret is encrypted in the window, and a card with a one-time link is added to your message. You can name the only people who may open it.

Good to know

  • The Squawk Secret tab in Teams creates links to copy anywhere and shares your Squawk Drop link.
  • Post “link opened” and “new Squawk Drop item” notices to a Teams channel with a webhook in Teams format.
  • The finished link passes through Microsoft Teams and our server to become the card, as a link in an email would; add a passphrase shared another way for full end-to-end protection.

Business

Outlook add-in

Send secure links, attachments, and requests without leaving Outlook.

How it works

  1. A Microsoft 365 admin adds it for your organization once, from the Microsoft 365 admin center; one package can add both the Outlook add-in and the Teams app (the steps are on the Microsoft 365 apps page in Squawk Secret).
  2. While writing an email, choose Squawk Secret in the ribbon and sign in once.
  3. Insert a one-time link to a password or a Login, Wi-Fi, or Server card; turn the email’s attachments into a secure link; insert a request link; or add your Squawk Drop link.

Good to know

  • Everything is encrypted in the add-in before it’s uploaded, the same as the website. Links can be locked to the email’s recipients, who confirm a code.
  • Works in new and classic Outlook for Windows, Outlook on the web, and Outlook for Mac.
  • Everyone can disconnect their Outlook sign-ins in Settings; “Sign out everywhere” disconnects them too.

Business

Custom domain

Client links on your own domain, like secure.yourfirm.com.

How it works

  1. Under Custom domain, enter the domain you want, such as secure.yourfirm.com.
  2. Add the two DNS records shown: a CNAME pointing the domain to us, and a TXT record proving it’s yours. We check automatically.
  3. Once both are found, HTTPS is set up for it automatically, and new squawk, request, Squawk Drop, and chat links, including the ones we email, use your domain.

Good to know

  • Your team still signs in at Squawk Secret; your domain serves only the pages your clients see.
  • Only your organization’s links can be opened on your domain.
  • If the domain ever stops pointing to us, new links go back to our address automatically. Links sent earlier keep working.

Try every feature free.

Start 7-day free trial Compare plans

Card required for the 7-day trial. Cancel anytime before it ends and you won't be charged; trials have small daily limits, file attachments turn on with your paid plan.