Security basics

How to Share a Password Securely (Without Email or Text)

8 min read

At some point, almost everyone needs to hand a password to someone else — a new hire needs access to a shared account, a family member needs the Wi-Fi key, a client needs a login for a staging site. The instinct is to use whatever's closest: email, a text message, a Slack DM. All three are worse choices than most people realize.

Why email is a bad channel for passwords

Email is designed to be permanent and searchable. Once you send a password by email, it typically lives in at least four places: your sent folder, the recipient's inbox, and both providers' backup systems. If either account is ever compromised — even years later — that password is sitting there in plain text, easily found by searching for words like "password" or "login."

Many email providers also scan message content for spam filtering, ad targeting, or "smart" features, meaning the password may pass through systems never intended to handle sensitive credentials.

Why text messages aren't much better

SMS messages are typically unencrypted in transit and are frequently backed up automatically to cloud services tied to your phone. A password sent by text can end up duplicated across a phone, a cloud backup, and a carrier's systems — all without anyone intending for that to happen.

Why Slack and Teams messages are risky

Workplace chat tools retain message history by default, often indefinitely, and are searchable by anyone with the right permissions — including future employees who join a channel later and can scroll back through years of history. A password dropped into a channel "just for now" frequently outlives the reason it was shared.

What a safer process looks like

Use a one-time link instead of pasting the password directly. A tool that generates a self-destructing link means the password itself never sits in a permanent chat log or inbox — only a link does, and that link stops working after it's opened.
Split the delivery across two channels. Send the link by email and a password-protecting passphrase by text (or vice versa). Even if one channel is compromised, the secret stays protected.
Set a short expiry window. If the recipient doesn't need days to act on it, limit the link to an hour or two so an unopened link doesn't linger as a liability.
Confirm receipt, then assume the link is dead. Once you know the recipient has it, treat the original link as gone — because for one-time links, it is.

A quick example

Say you need to give a contractor temporary access to a CMS login. Instead of typing the password into a Slack message, you'd paste it into a one-time secret tool, set it to expire after a single view or a few hours, and send the resulting link. The contractor opens it, copies the password, and the link is immediately useless to anyone else — including if the Slack channel itself is later searched or exported.