How to Share Database Credentials Securely
Handing a connection string or database login to a freelancer without it living in your chat history.
A database connection string is deceptively dense. In a single line it often bundles the host, port, database name, username, and password, which means one pasted string is a complete map to your data. When you bring on a freelancer or contractor, they frequently need exactly this to get started, and the temptation is to drop it into an email or a project chat. That single message can then be searched, forwarded, and backed up far beyond the life of the engagement.
What is actually at risk
Unlike a single account password, database credentials often unlock customer records, order history, and anything else that lives in your tables. A leaked connection string can be enough for someone to connect directly and read or modify production data. Because the string is compact and easy to copy, it also spreads easily, which is exactly why it should never sit in a persistent channel.
Sharing a connection string the safe way
A one-time link keeps the credential out of any archive. It is encrypted in your browser before it is sent, stored only as ciphertext the server cannot read, and permanently destroyed once the recipient has viewed it. Here is a practical flow:
- Paste the full connection string, or the individual host, user, and password, into Burn the Secret.
- Add a passphrase for anything touching production and share it over a different channel.
- Set an expiry that matches when the contractor will actually pick it up.
- Send the link, confirm they retrieved it, and check the link has been consumed.
Reduce blast radius before you share
- Create a dedicated, scoped database user for the contractor rather than sharing an admin login.
- Grant only the permissions the task needs, and prefer read-only where possible.
- Point them at a staging or replica database instead of production when the work allows it.
- Rotate or revoke the credential the moment the engagement ends.
Combining a narrowly scoped credential with a self-destructing link means that even in a worst case, the exposure is small and short-lived. The service is free, requires no signup to create a link, and encrypts everything client-side.
Onboarding a contractor today? Create a secure link on Burn the Secret.