how to send a password securely how to send a password securely over email how to share a password securely

How to send a password securely (and why not by email)

Adrian Maverick · · 9 min read

Someone needs a password from you: a coworker covering your shift, a parent who can't get into the streaming account, a contractor setting up your website. The quick move is to paste it into an email or a text. That is the one move to avoid.

To send a password securely, use the sharing feature of a password manager if you both have one. If not, split it: send the username one way and the password another, for example the password by phone call, and never in the same email. Then have the other person change the password, or change it yourself once they are done. Don't put a password in an ordinary email at all.

Below: the options ranked, what to do if email really is your only route, and the clean-up step most people forget.

Why you shouldn't email a password

An ordinary email is encrypted on the way between mail servers. Google says "all Gmail messages use TLS automatically." That protects the trip. It doesn't protect the copies: one in your Sent folder, one in the recipient's inbox, more on every device you both read mail on, and in any backup or archive. Those copies can sit there, searchable, for years. Anyone who later gets into either account can type "password" into the search box. We walked through where those copies end up in is it safe to email your Social Security number?

The IRS, which deals with this daily, is blunt about it in its guidance for taxpayers who email its staff: "Never send a password by email." It also warns that "Encrypted email does not encrypt the subject line."

A password in a plain text message has the same problem. It stays in both phones' message history and backups.

First, ask whether you need to send it at all

The safest password is one you never send.

  • Use shared access instead. Many services let you invite another person with their own login: family plans, shared folders, delegate access to an inbox or calendar, extra users on a business account. They get in without ever knowing your password, and you can remove them later.
  • Set a temporary password. If you are giving someone a new account, set a one-off password and make them change it at first sign-in. Many work and admin tools have a checkbox for this.
  • Send a reset link instead. If someone is locked out of their own account, help them use the "Forgot password" flow so the reset goes to them.

If none of those apply, pick a method below.

How to send a password securely: the options, ranked

Rank Method What you need Where copies stay
1 Password manager sharing Both people use a password manager that supports sharing Inside both encrypted vaults
2 Say it on a phone call A phone Nowhere, unless someone writes it down
3 One-time link that expires A reputable one-time secret tool Nowhere once opened, if the tool deletes on view
4 Split channels Two different apps or services Half in each place
5 End-to-end encrypted email or messaging Both people on a service that supports it In both mailboxes, encrypted
Never Plain email or text, in one piece Nothing Readable in both accounts, for years

1. Share it from a password manager

Most password managers let you share a saved login with another person, or keep a shared folder for a family or team. The password travels encrypted and lands in their vault, not in an inbox. If you change it later, the shared copy updates. If you stop sharing, they lose access. This is the cleanest option for anything you share more than once, like a household Wi-Fi or streaming account.

2. Read it out on a call

Old-fashioned and very effective. Nothing is stored, and you know who you are talking to. Call a number you already have, not one from the message asking for the password. For long, random passwords this is tedious, which is a good argument for option 1.

3. Use a one-time link that expires

One-time secret tools let you paste a password and get a link that works once, or expires after a set time, and then the secret is deleted. Send the link by one channel. If the link has already been opened when the real person clicks it, you know someone else saw it, and you change the password. Pick a tool that encrypts the secret and states that it deletes it after viewing.

4. Split it across two channels

If you have to use everyday apps, never put the username, the password and the site in one place. For example:

  1. Email the username and the site address.
  2. Text the password, or say it on a call.
  3. Send nothing that labels it. "Here's the password for the bank" next to the password is the worst combination.

An attacker who gets into one channel then has half of what they need.

5. Use end-to-end encrypted email or messaging

With end-to-end encryption, the message is locked on your device and unlocked on theirs, so neither provider holds a readable copy. A messaging app with end-to-end encryption and disappearing messages is a good fit for a single password. For email, see how to send an encrypted email, and for when an app beats email, see is Signal safer than email?

How to send a password securely over email, if you have no choice

Sometimes the other person only has email. Here is how to make it less bad.

Gmail's confidential mode. In a new message, click "Toggle confidential mode" at the bottom of the compose window. Google says you can "set an expiration date," "revoke access to an email at any time," turn off forwarding, copying, printing and downloading, and require an SMS passcode to open it. Google also warns: "they can still take screenshots or photos of your emails." Use an expiry of one day and remove access once the person confirms they have it.

Outlook's Encrypt button. On Outlook.com and the new Outlook for Windows, Microsoft says that if you have a Microsoft 365 Personal or Family subscription, you can compose a message, select Options, then Encrypt, so that "your email message stays encrypted and doesn't leave Microsoft 365." Microsoft notes that "your account must have a qualifying Microsoft 365 subscription."

Either way, follow the same three rules:

  1. Don't put the password, or the word "password," in the subject line.
  2. Send the username in a different message, or by a different channel, from the password.
  3. Delete the message from your Sent folder and trash afterward, and ask the recipient to do the same.

After you send it: clean up

This is the step that makes the rest worth doing.

  1. Change the password once the other person no longer needs it, or have them change it to one only they know. A password that has been shared is a password more people know than you planned.
  2. Delete the message wherever you sent it, in Sent and trash.
  3. Turn on two-step verification for the account if you haven't, so the password alone is not enough to get in. See is two-factor authentication safe?
  4. Never reuse the shared password anywhere else. If you need a new one, our guide on how to create a strong password has a method you can remember.

Keep old logins sealed in your mailbox

If you regularly pass logins to the same people, a family member, a business partner, a bookkeeper, the mailbox you use matters as much as the method. In Secria Mail, every message stored in your mailbox, your Sent folder included, is kept under zero-access encryption, so an old message with a login in it is a sealed file, not a search result for whoever gets into the account. Your mailbox is protected with hybrid post-quantum encryption (ML-KEM-1024 with X25519) on every plan, free included, and every message gets its own AES-256 key.

The free plan has the same encryption as every paid plan and needs no phone number and no card, so the person you share with most can set up an address in a few minutes. The clean-up step above still applies: change shared passwords when they are no longer needed.

Frequently asked questions

Is it safe to email a password?

Not in an ordinary email. The trip between servers is usually encrypted, but readable copies stay in both mailboxes. The IRS tells taxpayers: "Never send a password by email." Use a password manager, a phone call or a one-time link instead.

Is it safe to text a password?

A standard text is no better than email, because the message stays in both phones' history and backups. An end-to-end encrypted messaging app with disappearing messages is much better, and splitting the username and password across two channels helps.

Should I send the password in a separate email?

It is better than one email with both, but only a little, because both messages land in the same inbox. Use a different channel for the password, like a call or an encrypted messaging app.

How do I send a password to IT or a coworker?

Usually you shouldn't. A real IT team can reset your password or give you access without knowing it. If someone claiming to be IT asks for your password by email, treat it as phishing. Our guide on how to spot a phishing email shows the signs.

Is a password-protected file a safe way to send a password?

It just moves the problem, because now you need to send the file's password. It is a fine way to send documents, as long as the file's password goes by phone. The steps are in how to send tax documents securely.

Share from a password manager when you can, split channels when you can't, and change the password once it has done its job. If you'd like a mailbox where old messages stay sealed, you can try Secria Mail free.

Sources

Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.

Back to all posts