How to ask someone to send you a password
Sometimes you are the one who needs the secret — a Wi-Fi code, a database URL, an API key they already have. Asking them to “just email it” leaves that secret in two inboxes for years. There is a better pattern.
Why “email it to me” is still a problem
The usual request sounds harmless: “Can you send me the password?” They paste it into email or chat, you copy it, and everyone moves on. The message does not move on. It sits in both accounts, on every synced phone and laptop, in backups and often in search, usually until someone deletes it on purpose — which almost nobody does. Later, one compromised inbox is enough; an attacker searches for “password” or “api key” and finds it.
The same problem shows up in the other direction, which is why there is a companion guide on how to share a password safely. This page is for when you need to start the request.
A reply link instead of a reply email
A letterbox gives you two links:
- A write-only reply link to send them. Their browser encrypts whatever they type to a lock (a public key) that belongs to you. The page then forgets the text. That link cannot decrypt anything, so leaving it in chat is much safer than leaving the password itself.
- A private pickup link that you keep. The decryption key sits after the
#in the address, a part browsers never send to servers. Open it, wait if you like (the page notices when something arrives), then reveal the secret once. The server copy is deleted in the same step.
You never see their password while they type it, and they never see your pickup key.
What to say when you send the link
Keep it plain. For example: “Could you put the Wi-Fi password in this one-time page instead of emailing it? It encrypts the secret so only I can open it, and the link dies after I read it.” Mention what you need (Wi-Fi, API key, door code) in the message, not inside a field on the letterbox — there is no plaintext label stored with the request.
What can still go wrong
- Anyone who has the reply link can fill it first, with junk or a lookalike secret. They still cannot read a real reply afterwards. If the pickup page shows something you did not expect, do not use it; close that letterbox and ask again on a call or in person.
- “Posted” is not “opened”. The sender sees a posted mark and can check whether it is still sitting in the letterbox, but there is no read receipt. If it matters that you have it, tell them yourself.
- The sender gets one look before posting, with stray spaces and invisible characters pointed out, because they cannot read it back or correct it afterwards. If they got it wrong, open a new letterbox.
- If you lose the pickup link, nobody can recover it — not them, not the site. Bookmark it before you close the tab.
- The letterbox closes after the timer you picked, whether or not they have replied, and whether or not you have collected. Pick the shortest time that will actually work.
- Encryption cannot help if the device that opens the pickup link is compromised, or if you then paste the secret into a permanent note.
When a letterbox is the wrong tool
If a team will keep using the same login, a shared vault in a password manager is better: it can be revoked and nobody has to send the secret again. If they are happy to create a one-time note themselves and paste you that link, that is just as safe — a letterbox is simply the version where you start, and you get a page that waits for the reply.