I need to send a user a link via SMS that when clicked, and then when some demographic info is verified, will allow them to sign up for my service (which is a healthcare portal, so HIPAA/PCI/PII etc).

Once the link is clicked the code will appear on the web page in plain text.

I'm telling the busines that I want to encode the code in the link that will be in the text msg since it is technically sensitive. However, I am not sure that I really know why I am suggesting it, especially since the code will be output in plain text when the link is clicked. So I am having trouble making my case. If someone intercepts the link and clicks it, they have the code.

If the phone is stolen the user will be SOL so I can't worry about that. I suppose I am mostly protecting against the phone company or anyone else the code passes through on its way to the phone.

The code does expire after a certain amount of time.

Should I bother encoding it? Is the real problem showing the code on the page--if I don't do that, does encoding make sense?

  • I'm not sure I understand. Given a perfect scenario, how does encoding offer protection?
    – schroeder
    Jul 6, 2015 at 17:36
  • We don't want the code in plain text, because a human error on the call center level could lead to it being used. "Oh I got this code in the mail but I can't use it, you guys must have my DOB wrong in your system." Even though the code it self is encoded it just seems wrong to send it in plain text in a URL and then just barf it onto a web page. Jul 6, 2015 at 17:46

1 Answer 1


Reverse engineering what you are trying to do from the question: You are sending an activation link to the user out of band, and are worried about interception when clicked.

Yes, we have the technology to prevent the link from being intercepted while being clicked.

It's called "HTTPS". In other words, make sure that the activation link look like this: https://example.com/signup?token=1235

  • That's pretty close. So in your example "1235" would be a useful token but only if used in combination with something else. I am more concerned with someone intercepting the actual hyperlink and knowing that "1235" goes with a certain mobile number, and being able to do harm from there with those 2 pieces of info. Jul 6, 2015 at 20:39
  • I would suggest as a best practice: - Every link you generate should be HTTPS - You are sending the user a link, which upon clicking will show some information. Hence, you can store all that information on the server, give the user a temporary, randomly generated token instead. When clicked, lookup the data from the db, show it. Using this, you can even poof the information after x uses or y minutes. An attacker on the network will be stopped by the first item. An attacker in the users mailbox will be stopped by the second. Jul 16, 2015 at 0:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .