How to Send a Password Securely

At some point everyone has to send someone a password. The instinct is to type it straight into an email, a text, or a chat message. That feels quick, but it leaves the password sitting in a place that remembers everything: inboxes, sent folders, message archives, and backups. The safest way to send a password is to make sure it exists only long enough to be read, and then disappears. This guide covers the simple method for doing exactly that.

The one rule: never send a password in plain text

Plain-text passwords in messages are the root of most avoidable exposure. Email is permanent and forwardable. Text messages persist on devices and carrier systems. Chat tools keep searchable histories. In every case, the password outlives the moment it was needed and waits around to be found later. Deleting the message helps a little, but backups and exports may already have captured it. The reliable fix is to never put the raw password into the channel at all.

The secure method: a one-time link

A one-time link lets you use any channel to deliver a password while keeping the password itself out of that channel's permanent record. Here is how it works under the hood:

• The password is encrypted in your browser with AES-256-GCM before anything is sent.
• The decryption key lives in the URL fragment, the part after the # symbol, which browsers never transmit to servers.
• The server stores only unreadable ciphertext, so even it cannot see the password.
• After the recipient views it once, the secret is permanently deleted.

You share a link, not a password, and once it is opened there is nothing left to leak.

Step by step

1. Go to Burn the Secret and paste the password.
2. Optionally add a passphrase the recipient must enter to unlock it.
3. Choose an expiry so an unopened link does not linger.
4. Create the link and send it through email, chat, or text.
5. Send the passphrase, if you used one, through a different channel.

A few habits that help

• Split the link and passphrase across two different channels for sensitive accounts.
• Use the shortest expiry that is practical.
• Ask the recipient to confirm they retrieved it so you know it was not intercepted.
• Consider rotating the password afterward when the access only needed to be temporary.

Burn the Secret is free, requires no signup to create a link, and supports passphrases, expiries, file attachments, and an API for automating the whole thing.

Ready to do it the safe way? Create a secure link on Burn the Secret.