Why links should not contain usernames or passwords

What it is

Some URL formats can include usernames or passwords before the host. Modern sites should not ask you to trust links that contain credentials.

Why it matters

Credentials in links can expose secrets in browser history, logs, screenshots, analytics, and forwarded messages. They can also disguise the real destination.

Warning signs

• The link contains username:password@ before the domain.
• The URL appears to include an email address, password, token, or access key.
• The credential-looking text appears before an @ sign in the address.
• The link is trying to make one destination look like another.

What to do

1. Do not open credential-bearing links from unexpected messages.
2. Never paste passwords, API keys, recovery codes, or tokens into a URL.
3. If you shared such a link, revoke the token or change the credential.
4. Use application-approved sharing, invite, or login flows.

Examples

Risky: https://trusted.example@attacker.example/login

Safer: Treat the site after the @ as the destination, and do not sign in.

Risky: A copied dashboard URL contains a long private token.

Safer: Use the application's share feature or create a scoped invite link.

Common mistakes

• Reading the text before the @ as the real site.
• Sharing a copied URL that contains private access tokens.
• Assuming credentials in links are a normal way to sign in.

Key takeaway: If credentials or private tokens appear inside the link, stop and use a safer sign-in or sharing method.