Depends on your threat model. If you're protecting against dragnet surveillance and retroactive targeted surveillance, after your link expires, then just puttin

Depends on your threat model. If you're protecting against dragnet surveillance and retroactive targeted surveillance, after your link expires, then just putting the password right there in the e-mail body, with an expiring link, should work fine. For now. Especially if it's not life-or-death, but you'd just "rather not appear in the data set, if avoidable." To each their own :)