How to share a password safely
Sooner or later you have to hand someone a password, an API key, a Wi-Fi code or a recovery code. Here is why the obvious ways are risky, and what to do instead.
Why chat and email are a bad home for secrets
A password pasted into a chat app or an email doesn't disappear when the other person reads it. It stays in both accounts, on every phone and laptop that syncs them, in backups and often in search indexes, usually for years. Nobody has to intercept anything: the risk is that one of those accounts is broken into later, and the attacker searches for the word "password". Screenshots of passwords are worse, because they also end up in photo backups.
Four safer ways, from quickest to strongest
- A one-time link. Put the secret in a note that is encrypted in your browser and burns after one read. What stays behind in the chat is a dead link, not the password. If the note says "already read" when your friend opens it, someone else got there first, so change the password.
- Add a passphrase sent another way. Protect the note with a short passphrase and send that by a different route: say it on a call, or text it while the link goes by email. An attacker now needs both channels.
- Hand it over in person. To move a code from your laptop to a phone, or to someone sitting next to you, show the one-time link as a QR code and let them scan it. Nothing is typed, emailed to yourself or left in a clipboard history.
- Use a password manager for anything shared long-term. If a team or family keeps using the same login, a shared vault in a password manager is better than any message: it can be revoked, it records changes and nobody has to send it again.
Small habits that matter
- Never send the site, username and password in one message. Split them up.
- Pick the shortest expiry that works. A note that waits 7 days is a note that can be found for 7 days.
- When the job is done, change the password, especially for temporary access such as a contractor or a holiday let's Wi-Fi.
- Prefer giving people their own account over sharing yours, so access can be removed without changing everyone's password.
- For a brand-new password, generate a long random one instead of inventing it, for example with a password generator that runs in your browser.
What if you need them to send you the password?
Don't ask them to paste it back in email. Open a letterbox and send them the write-only reply link instead. Their browser encrypts the secret to a key that lives only in your private pickup link, so the chat never holds the password. The companion guide walks through what to say and what can still go wrong.
What a one-time link can't fix
It protects the secret on the way and while it waits. It can't help if the reader's device is infected, if they copy the password into a note app, or if you send the link to the wrong person. Read how Fusenote works for the full details of what is and isn't stored.