How to Send a Password Securely (and Only Once)

Sooner or later you have to give someone a password: the Wi-Fi for the office, the first login for a new hire, the admin account of a client’s website. The way most of us do it, pasting it into email or chat, has one big flaw. It is not that someone intercepts it on the way. It is that it never goes away.

That message sits in two accounts, in their backups, on every phone and laptop signed in to them. Years later, one compromised mailbox search for “password” finds it.

So the goal is simple to state: the secret should be readable once, by the right person, for a short time, and ideally you can take it back.

The methods at a glance

Share links: 1Password, Bitwarden Send, Proton Pass. One-time secret links: Yopass, One-Time Secret, Password Pusher. Features as each vendor documents them, checked October 2026.

Here are the ways to get there, roughly in order of how often they are the right answer.

1. Do not send the password at all

If you both use a password manager, share the item instead of the text. Shared vaults (1Password, Bitwarden, Dashlane, Keeper and others) give the other person access that follows their membership: remove them from the vault and the access is gone, change the password and everyone has the new one. For credentials people use every week this beats every other method, because there is nothing to clean up.

Better still, where a service supports it: invite the person as their own user and never share a credential at all.

2. A password manager’s share link

For someone outside your vault, most managers can make a link to a single item with limits: an expiry from an hour to about 30 days, a restriction to named email addresses, and a single view if you want it. Bitwarden’s Send does the same for any text or file, with a deletion date, a maximum number of opens and an optional password.

This is a good default. Two cautions: the link is only as private as the channel you send it through, and a link restricted to “anyone who has it” is exactly that.

3. A one-time secret link

Services such as One-Time Secret, Yopass and Password Pusher do one thing: you paste a secret, you get a link, and the link shows the secret once and then destroys it. All three are open source and can be self-hosted. They differ on one point that matters: Yopass encrypts in your browser, so its server stores something it cannot read, while One-Time Secret and Password Pusher say in their own documentation that encryption happens on their servers. On their public sites you are trusting the operator.

(We compare them in One-Time Secret Alternatives.) They are quick and free, and they have one famous sharp edge: something else may open the link first. This is documented, not folklore:

• Slack’s link expander fetches every link posted in a channel to build its preview.
• Microsoft Defender’s Safe Links can hold an email until every URL in it has been scanned.
• Password Pusher’s own FAQ says that a link shared in WhatsApp shows up in its view log straight away, with “WhatsApp Bot” as the visitor.

Any of these can spend a single view before your recipient sees it, and they get “this secret has already been viewed”. The fix is a click-to-reveal step: Password Pusher’s “1-click retrieval” page, Yopass’s warning before it reveals a one-time secret, One-Time Secret’s separate reveal button. Add a passphrase as well, and tell it by phone.

4. Split it across two channels

Old advice, still good: send the username by email and the password by text, or the link in chat and the passphrase in a call. An attacker now needs both channels. It costs thirty seconds and it combines with everything above.

The same trick is the core of sending credit card details securely, though there the better move is usually not to send them at all. If you were about to use your mail provider’s own option, Gmail confidential mode is worth understanding first.

If email is the only channel you have

Email between the big providers is encrypted on the way, so interception is rarely the problem. The problem is the same one as everywhere else: the message stays in both mailboxes, in their backups and on every device signed in to them, and a search for “password” finds it years later. If you have to use email:

• send an expiring link by email, not the password itself;
• send the passphrase, or the password itself, by phone or text, never in the same thread;
• leave the username and the site out of that email, or send them separately;
• ask for the password to be changed at first login.

Your provider’s built-in option does less than its name suggests. Read what Gmail confidential mode and Outlook’s Encrypt and Do Not Forward actually do before relying on either.

Recovery codes are a related but separate job: they are not sent to anyone, they are kept for the day you are locked out, and the obvious places fail on exactly that day. That one is Where to Store Your 2FA Recovery Codes.

What all of these lack

Three things tend to matter to an organisation, and the link-based methods do not give them:

• Taking it back. Once a link is opened, the secret is on the other side. You cannot revoke a password you pasted; you can only change it. Corporate mail does not solve this either: Outlook’s Do Not Forward restricts what the recipient’s software will do, not what they can read or retype.
• Knowing it reached the right device. A link works for whoever holds it.
• Working where people already are. Staff, contractors and clients live in WhatsApp, WeChat, Telegram, iMessage (and no, a chat history is not a safe place for a password). A link to an unfamiliar site is exactly what we train people not to click.

For teams: a secret that travels through a photo

This is the gap we built WaxSeal for. The sender chooses any photo, types the secret and picks who may read it. The secret is encrypted on the sender’s device for those recipients’ devices, whose keys live in the Secure Enclave, and the organisation’s vault stores only ciphertext it cannot open. The photo carries an invisible reference that survives chat-app compression, so it can be sent in whatever app the recipient already uses. There is no link to preview, scan or spend.

The recipient opens the photo in WaxSeal with Face ID or Touch ID. The sender decides what that means:

• burn after reading, or a fixed number of opens;
• expiry: an hour, a day, a week;
• an optional PIN told over the phone, with five attempts before the seal is destroyed;
• revoke at any time: the photo stays in the chat and simply stops opening. An admin can also revoke a lost or departed person’s device, which ends its access to everything.

Two honest limits. A burn or a revocation ends further authorised opening; it cannot un-show what someone has already read, so you still rotate a credential you no longer trust. And WaxSeal is a team product: sending to other people happens inside an organisation’s workspace (recipients are free). For one password between two friends, a one-time link and a phone call are the right tool.

A short checklist

1. Can you share access instead of the password? Do that.
2. Otherwise use something that expires and opens once.
3. Put the second factor, a passphrase or PIN, on a different channel.
4. If the secret must be revocable or tied to a specific person’s device, use a tool built for that.
5. Whatever you used: change first-login passwords on first use.

If you want to see the photo approach for yourself, WaxSeal’s personal demo runs on a single iPhone, iPad or Mac with no account: hide a test message in a photo, open it again, watch it burn. More on the design in A Photo You Can Take Back; plans are on the WaxSeal pricing page.