Sooner or later everyone has to send someone a password — a website login, a Wi-Fi code, an API key, a database credential. The quick instinct is to drop it into an email, a WhatsApp chat, or a Slack message. Please don't. Here's why, and what to do instead.
Why email, WhatsApp and Slack aren't safe for passwords
The problem with all three is the same: the password stays there forever.
- Email is not encrypted end-to-end. Copies sit on mail servers, in backups, and in the recipient's inbox indefinitely — anyone who later gains access to either account can read it.
- WhatsApp encrypts messages in transit, but they linger in cloud chat backups (iCloud/Google Drive) that often aren't encrypted, and on every device in the chat.
- Slack / Teams store messages on company servers that admins — and any future breach — can access.
A password you sent last year can quietly resurface in a data breach years later. The fix is to share it in a way that leaves nothing behind.
The safe ways to share a password
1. A one-time, self-destructing link (no setup)
The simplest option needs no account from you or the recipient. You paste the password into a tool that encrypts it, get a single-use link, and share that link. The moment the recipient opens it, the secret is permanently destroyed. Our free One-Time Secret tool does exactly this — and it's zero-knowledge: the encryption happens in your browser and the key never reaches our servers, so even we can't read what you send.
2. A password manager's sharing feature
If you and your team already use a password manager (Bitwarden, 1Password, Keeper), its built-in sharing keeps the credential encrypted end-to-end. Great for ongoing team access — though it usually requires both people to use the same tool.
3. An encrypted messaging app
Signal and similar apps are end-to-end encrypted. Better than SMS or regular email, but the message can still sit in the chat history unless you enable disappearing messages.
How to share a password with a one-time link, step by step
- Open the One-Time Secret tool.
- Paste your password or note into the box.
- Optionally add a passphrase (share it separately, e.g. over a call) and choose an expiry (5 minutes to 7 days).
- Click Create secret link and send the link to your recipient.
That's it. The link works once; after that — or after it expires — it's gone.
Two extra tips
- Use a strong password to begin with. Generate one with our free Password Generator, then share it through the one-time link.
- Add a passphrase for anything sensitive. It means that even if the link is intercepted, it can't be opened without the second secret you shared over a different channel.
The bottom line
Never paste a password into email, WhatsApp, or Slack. For a one-off, use a self-destructing one-time link; for ongoing team access, use a password manager's sharing. Both keep your credentials out of inboxes and chat logs — which is exactly where attackers look first.
