How to send a password securely

The short answer

Don't paste the password into the message. Put it behind a link that:

• is encrypted, ideally in your browser, before it leaves your device;
• expires after a set time, or after it has been opened;
• is protected by a passcode you send through a different channel.

Then send that link by email, Slack or Teams. The message carries only a link that soon stops working, not the password.

Why is sending passwords by email or chat risky?

Email and chat are built to keep messages, which is the opposite of what you want for a password.

• Copies everywhere. The message sits in your sent folder, the recipient's inbox, server backups and every device that syncs them.
• Search. Anyone who later gets into either mailbox or workspace can search for "password".
• Forwarding. A message can be forwarded, or quoted in a reply chain, to people you never intended.
• Previews and notifications show message content on lock screens and in notification centres.
• Long retention. Workspace and email retention policies often keep messages for years.

A password sent this way stays readable long after it was needed. An expiring link doesn't.

What are the safer ways to send a password?

How do you send a password securely by email?

1. Create a secure link. In CredenShare, open Shares in the sidebar and click Create Share. Fill in the Email and Password fields (add more if you need them), and give it a title.
2. Set the rules. An expiry (for example 48 hours, or counted from the first open), a view limit, and a passcode.
3. Click Create Secure Share, copy the link into your email, and send the passcode separately, by text message or a phone call.
4. Send the link as plain text. Some email security filters open links to scan them, which can use up a one-view link. Plain text, or allowing a second view, avoids that.
5. Check the access log afterwards to confirm it was opened, and when and from where.

How do you send a password securely on Slack?

• With the CredenShare Slack app (Plus and above), create a share from Slack and send it to the people you choose. The app messages the recipients directly with a link.
• Without it, create the link in CredenShare and paste the link, never the password, into the Slack message. Send the passcode through a different channel.

Note: shares created from Slack are encrypted on CredenShare's servers, because the credential passes through Slack first. Shares created in the web app are encrypted in your browser.

How do you send a password securely on Microsoft Teams?

1. Create a share in CredenShare in your browser, with an expiry, a view limit and a passcode.
2. Paste the link into the Teams chat.
3. Send the passcode through another channel, such as a text message or a call.
4. Check the access log once it's opened.

How do you get a password from someone securely?

Asking a client to "just email it" puts their password in your inbox. Instead:

1. Create a Secure Request (Business and Enterprise) with the fields you need, for example Registrar, Username, Password.
2. Send them the link. They fill in the form in their browser, which encrypts each answer before sending it.
3. Open the submission in CredenShare, then save it into your password manager.

Before you share a credential: a checklist

These apply whichever tool you use.

1. Send the link and the passcode through different channels. For example, the link by email and the passcode by text message.
2. Watch out for link scanners. Some email security filters and chat apps open links automatically, which can use up a one-view link. Send the link as plain text through a channel that doesn't pre-open links, or allow a second view with a short expiry.
3. Don't open the link to test it. On a one-view link, your test is the view.
4. Pick the shortest expiry that works. If you don't know when the recipient will act, a link that starts counting at the first open is safer than a long fixed window.
5. Rotate after the handoff when you can. The link expires, but the credential is still valid.
6. Keep the original in your password manager. A sharing link is a delivery method, not storage.

Common mistakes when sharing passwords

• Pasting the password into the message. Email and chat keep copies in sent folders, backups and every forward. Send a link that expires instead.
• Sending a one-view link through a scanning mail filter. The filter's check can use up the view. Send the link as plain text, or allow two views with a short expiry.
• Sharing a whole vault or folder to give someone one password. Share the single item, or send a copy through a link.
• Sending the passcode in the same message as the link. Use a second channel, such as a text message or a phone call.
• Forgetting to rotate. When a contractor's work ends, the shared password is still valid until you change it.
• Asking someone to "just email it". If you need a password from someone, give them a form that encrypts it.

What to do if you already sent a password by email

1. Change the password as soon as you can. That's the only way to make the emailed copy useless.
2. Delete the message from your sent folder, and ask the recipient to delete theirs. Copies may remain in backups, which is why changing the password comes first.
3. Next time, send a link instead.

Summary

• Never paste a password into an email or chat message.
• Send an encrypted, expiring link with a passcode through a second channel.
• To receive a password, send a request form, not an email.
• Change any password that has already travelled in plain text.

Related: How to share a password one time, for free · CredenShare vs 1Password · All comparisons

Product names are trademarks of their respective owners. CredenShare is not affiliated with them.