Frequently asked questions

How do I redeem a token?

Visit the WORO home page or account page, paste the redeem token into the input, and choose Retrieve value. You do not need to sign in. A successful retrieval displays the value and deletes WORO's stored copy.

Should I share a full redeem URL?

Prefer sending the redeem token as plain text and asking the recipient to enter it on the WORO site. A full redeem URL can be visited automatically by link previews or security scanners. Opening that URL sends the retrieval request, so a scanner that makes a GET request could retrieve the secret before the recipient sees it.

Browser extensions can also, in theory, inspect URLs, page contents, or network requests. Entering a token manually avoids automatic link-following; it cannot protect against an extension or other software that can inspect the browser, a compromised device, or someone who receives the token. Treat the redeem token like a bearer credential and use a device you trust.

Can the sender see whether I redeemed it?

The sender can see whether an exchange is pending, redeemed, expired, or revoked on their account page. A redeemed status records that WORO completed a retrieval operation. It does not identify who made the request or prove that a person received, read, or retained the response.

Can the sender revoke a token?

Yes. The sender can revoke a pending exchange from the account page. Retrieval and revocation use a single-winner claim, so only one can proceed. If retrieval has already claimed the exchange, it can no longer be revoked.

How long does a secret stay available?

An unredeemed value expires after 14 days. WORO deletes the stored value on read. Only one request can claim and retrieve an exchange. A network or service failure can still mean the recipient does not receive the response, even though the stored value has been deleted.

Can WORO read the secret?

WORO can read content that you send without encrypting it first. Stored data is encrypted at rest, but that is not end-to-end encryption. Encrypt the secret before sending it if WORO itself must not be able to read the contents.

What does “not found” mean?

A not-found response means the token is unknown, expired, or has already been redeemed. WORO does not distinguish those cases in the response.