How to Send a Password Securely (and Only Once)

Sooner or later you have to give someone a password: the Wi-Fi for the office, the first login for a new hire, the admin account of a client’s website. The way most of us do it — paste it into email or chat — has one big flaw. It is not that someone intercepts it on the way. It is that it never goes away.

That message sits in two accounts, in their backups, on every phone and laptop signed in to them. Years later, one compromised mailbox search for “password” finds it. So the goal is simple to state: the secret should be readable once, by the right person, for a short time — and ideally you can take it back.

Here are the ways to get there, roughly in order of how often they are the right answer.

1. Do not send the password at all

If you both use a password manager, share the item instead of the text. Shared vaults (1Password, Bitwarden, Dashlane, Keeper and others) give the other person access that follows their membership: remove them from the vault and the access is gone, change the password and everyone has the new one. For credentials people use every week this beats every other method, because there is nothing to clean up.

Better still, where a service supports it: invite the person as their own user and never share a credential at all.

2. A password manager’s share link

For someone outside your vault, most managers can make a link to a single item with limits — an expiry from an hour to a few weeks, a restriction to named email addresses, in some cases a single view. Bitwarden’s Send does the same for any text or file, with a deletion date, a maximum number of opens and an optional password.

This is a good default. Two cautions: the link is only as private as the channel you send it through, and a link restricted to “anyone who has it” is exactly that.

3. A one-time secret link

Services such as One-Time Secret, Yopass and Password Pusher do one thing: you paste a secret, you get a link, and the link shows the secret once and then destroys it. Several are open source and can be self-hosted; the better ones encrypt in your browser, so the server stores something it cannot read.

(We compare them in One-Time Secret Alternatives.) They are quick and free, and they have one famous sharp edge: something else may open the link first. Chat apps fetch links to draw a preview. Corporate mail gateways open links to scan them. Either can spend your single view, and the recipient gets “this secret has already been viewed”. Guard against it with a service that has a click-to-reveal step or a passphrase — and tell the passphrase by phone.

4. Split it across two channels

Old advice, still good: send the username by email and the password by text, or the link in chat and the passphrase in a call. An attacker now needs both channels. It costs thirty seconds and it combines with everything above.

The same trick is the core of sending credit card details securely — though there, the better move is usually not to send them at all. If you were about to use your mail provider’s own option, Gmail confidential mode is worth understanding first.

What all of these lack

Three things tend to matter to an organisation, and the link-based methods do not give them:

• Taking it back. Once a link is opened, the secret is on the other side. You cannot revoke a password you pasted; you can only change it.
• Knowing it reached the right device. A link works for whoever holds it.
• Working where people already are. Staff, contractors and clients live in WhatsApp, WeChat, Telegram, iMessage (and no, a chat history is not a safe place for a password). A link to an unfamiliar site is exactly what we train people not to click.

For teams: a secret that travels through a photo

This is the gap we built WaxSeal for. The sender chooses any photo, types the secret and picks who may read it. The secret is encrypted on the sender’s device for those recipients’ devices — their keys live in the Secure Enclave — and the organisation’s vault stores only ciphertext it cannot open. The photo carries an invisible reference that survives chat-app compression, so it can be sent in whatever app the recipient already uses. There is no link to preview, scan or spend.

The recipient opens the photo in WaxSeal with Face ID. The sender decides what that means:

• burn after reading, or a fixed number of opens;
• expiry — an hour, a day, a week;
• an optional PIN told over the phone, with five attempts before the seal is destroyed;
• revoke at any time — the photo stays in the chat and simply stops opening. An admin can also revoke a lost or departed person’s device, which ends its access to everything.

Two honest limits. A burn or a revocation ends further authorised opening; it cannot un-show what someone has already read, so you still rotate a credential you no longer trust. And WaxSeal is a team product: sending to other people happens inside an organisation’s workspace (recipients are free). For one password between two friends, a one-time link and a phone call are the right tool.

A short checklist

1. Can you share access instead of the password? Do that.
2. Otherwise use something that expires and opens once.
3. Put the second factor — passphrase or PIN — on a different channel.
4. If the secret must be revocable or tied to a specific person’s device, use a tool built for that.
5. Whatever you used: change first-login passwords on first use.

If you want to see the photo approach for yourself, WaxSeal’s personal demo runs on a single iPhone, iPad or Mac with no account: hide a test message in a photo, open it again, watch it burn. More on the design in A Photo You Can Take Back; plans are on the WaxSeal pricing page.