You send a sensitive message and then something changes. The recipient's role changed, the deal fell through, you realise the address was wrong, or the window you set was too generous. An expiring link will die on schedule, but schedule is not what you need now. You need to end it.
To share a sensitive message with a link that can be revoked is to keep that control. This guide explains how revocation differs from expiry and one-time opens, how to send a revocable link, when to pull it, what revoking cannot undo, and the mistakes that make revocation arrive too late.
Three controls, three different failures
| Control | What it does | The failure it covers | | --- | --- | --- | | Expiry | Destroys the secret at a set time | A link that nobody opened, forgotten in a thread | | One-time open | Destroys the secret the first time it is revealed | Copies lingering after the handoff is done | | Revocation | Destroys the secret now, on your decision | Circumstances changed before anyone opened it |
An expiring link protects you from your own forgetfulness. A one-time link protects you from copies. Revocation protects you from the thing you only learned after sending. A LinkPilot secret link has all three: it burns on first open, it expires at the deadline you set, and until one of those happens you can revoke it from the dashboard and the link returns a gone response from then on. The expiring links guide covers what expiry protects and what it does not; this guide is about the third control.
What a revocable link cannot do
Revocation acts on the stored copy. It cannot reach:
- A message already revealed. The text is on the recipient's screen, in their clipboard, possibly in a screenshot.
- The wrong recipient who already opened it. Revoking afterwards changes nothing; the response is to rotate the credential or act on the content.
- Forwarding of the link itself before it is opened. Whoever opens it first gets the content. Revocation only helps if you act before that.
So revocation is a control for the gap between sending and opening. Keep that gap short and watch it.
Send a revocable link
- Verify the recipient through a channel you already trust. Most revocations that matter are the result of a misaddressed message, and the check is cheaper than the recovery.
- Include only what the recipient needs. One credential, one piece of information, one task. The less in the link, the less a revocation that comes too late has to cover.
- Create the link in the secret link tool or from your LinkPilot account. The text is encrypted in your browser before it is stored. A signed-in account gives you the link in your Secret Links list, which is where you revoke it from.
- Set the expiry to the real window, an hour or a day, and the view limit to one. Expiry is the backstop; the single open is the main control; revocation is the override.
- Add a passphrase on a Pro account for a message that would be serious if forwarded, and send the passphrase by a different route.
- Send the link with one line about what it is and when it ends. Tell the recipient to open it only when they are ready and on a device they control.
When to revoke
- The recipient no longer needs it. The task was cancelled, the hire fell through, the work moved to someone else.
- You chose the wrong recipient. Revoke first, then explain.
- The link went somewhere public: a group channel, a ticket many people read, a forwarded email.
- The window was too long. You set seven days and the handoff finished in an hour. Revoke rather than leave it live for six more days.
- Anything feels off. A reply from an unexpected address, a request to resend to a different account, a recipient who says they cannot open it when the dashboard says it is unopened.
Revoking costs nothing. Create a fresh link for the right person when the situation is clear.
Watch the link while it is live
From a LinkPilot account the secret shows its status: active, revealed, expired or revoked. Pro accounts also see an audit timeline with the time of each event. The useful habit is a single check after sending:
- Unopened and the recipient is ready: fine, wait.
- Opened and the recipient confirms: done, nothing to revoke.
- Opened and the recipient did not open it: treat the content as exposed. Rotate the credential or act on the information, then look at how the link travelled.
- Unopened and anything above applies: revoke now.
The who-opened-it guide explains what a reveal record can and cannot tell you about the person on the other end.
Mistakes that make revocation arrive too late
- Assuming deletion is revocation. Deleting the chat message removes the link from view; the secret is still live until you revoke it in the tool.
- Posting in a group. With forty people able to click, revocation is a race you will lose. Send sensitive links directly.
- Sending the passphrase alongside. One exposed message then carries everything, and revocation has to beat the reader.
- Not testing the recipient path. A recipient who struggles to open a link asks for it to be resent, and resent links multiply. Try the flow once with a harmless message so the real one goes smoothly.
- Treating a revocable link as storage. It is a handoff. The recipient saves the content where it belongs, and the link is gone.
For a plain URL that should stop working on a date, LinkPilot's expiring link tool does that, and the link can be disabled early from the dashboard. The difference is that an expiring short link only stops redirecting; a secret link's revocation destroys the content itself.