How to share a password safely
Pasting a password into WhatsApp, Slack or email is easy, but it stays there: in both chats, in backups, and on every device that syncs them. A one-time password link fixes that. Your friend opens it once, sees the password, and the link stops working.
Create a one-time password link
Step by step
- Paste only the password into the box above. Leave out the username and the site name.
- Pick a short expiry. 1 hour or 1 day is plenty if they're expecting it.
- Send the link in the chat you normally use.
- Send the username or account separately, for example by phone or in a different app. Someone who sees only one half can't log in.
- Ask them to confirm they opened it. If they see “this note is gone” before reading it, someone else opened it first, so change the password.
Why a one-time link beats chat or email
- Nothing left behind. After it's read, only a dead link remains in your chat history.
- We can't read it either. The password is encrypted in your browser, and the key is in the part of the link after the #, which never reaches our server.
- You'll know if it leaked. A link can be opened once, so if someone else got there first, your friend will see it's already gone.
- It expires. If nobody opens it, it deletes itself.
Good habits when sharing passwords
- Don't share a password you use anywhere else. Make a separate one for the shared account.
- Change shared passwords when someone no longer needs access.
- For a team or family that shares often, use a password manager's sharing feature.
- Never share one-time passcodes or verification codes that a service sends you.
The same tool works for API keys, secret keys, recovery codes and private messages. See one-time secret links for more.
Password sharing questions
What's the safest way to send someone a password?
Send it through a link that can only be opened once and expires on its own, and send the username or the account it's for through a different channel. If you share passwords with the same people often, a password manager with a shared vault is even better.
What is a one-time password link?
A link that reveals a password once and then deletes it. If someone else opens it first, your friend will see that it's already been read, so you'll know to change the password.
Is it safe to text or email a password?
It works, but the password stays in both inboxes, in backups and on every synced device, often for years. Anyone who gets into either account later can find it. A one-time link leaves only a dead link behind.
Can I share a password with an OTP or verification code?
Don't share login codes. A one-time password (OTP) or verification code that a service sends you is meant only for you, and anyone asking for it may be trying to take over your account.