How to Securely Share Passwords with Coworkers

We've all been there. A coworker needs access to a shared account, a new team member is starting and needs login credentials, or someone's locked out and needs a password reset. The temptation is to just type it into Slack or fire off a quick email. But every time you do that, you're creating a security risk that could come back to haunt you.

Why you shouldn't just Slack it

Let's be real about why the quick-and-easy approach is dangerous.

Chat messages are searchable. Anyone with admin access can search Slack or Teams for "password" and find every credential ever shared. Former employees might still have access to exported chat histories.

Email lives forever. That email with the WiFi password from 2019? It's still sitting in someone's inbox. Email threads get forwarded, CC'd, and backed up across multiple systems.

Account compromises cascade. If a coworker's account is compromised, the attacker gets access to every password that was ever shared with them via chat or email.

The better way: one-time links

One-time links solve the persistence problem. Instead of sending the password directly, you send a link to the password. Once your coworker clicks it, the password is revealed and then permanently deleted.

The difference is simple. With Slack, a message like "Hey, the Netflix password is streamingFun2024!" is visible in search forever. With a one-time link, you send "Hey, here's the Netflix password: burnthesecret.com/secret/abc123" and the link expires after viewing.

How to share with a coworker

1. Go to Burn the Secret.io and enter the password or credential you need to share.
2. Click "Create Secret Link" to generate an encrypted one-time link.
3. Copy the link and send it to your coworker via Slack, email, or wherever.
4. Your coworker clicks the link, sees the password, and the link is destroyed.

Common scenarios at work

New employee needs access to shared accounts. Create a one-time link for each account instead of adding credentials to an onboarding doc. The link expires, but the doc would live forever.

Covering for someone on vacation. Need temporary access to a coworker's account? They can send a one-time link with the password. When they're back, they should change it.

Sharing WiFi or printer passwords. Instead of posting the office WiFi password in a Slack channel, send one-time links to new team members who need it.

Shared service accounts. Social media logins, analytics tools, or other shared accounts can be shared via one-time links instead of pinned messages.

Tips for workplace password sharing

• Ask for confirmation: Have your coworker let you know when they've successfully retrieved the password.
• Don't include usernames: If possible, send only the password. If the username is obvious (like a shared email address), don't bundle it with the password.
• Consider passphrase protection: For sensitive credentials, add a passphrase and tell your coworker verbally or via a different channel.
• Rotate after temporary sharing: If you shared a password for temporary access, change it when that access is no longer needed.
• Use the QR code: For in-person sharing, show the QR code on your screen and let your coworker scan it with their phone.

Getting your team on board

The hardest part of secure password sharing isn't the tools—it's changing habits. Here's how to get your team to adopt better practices:

1. Lead by example: Start using one-time links yourself. When you share a password, use Burn the Secret.
2. Explain the why: Share this guide with your team. Understanding the risks makes people more likely to change behavior.
3. Make it easy: Bookmark Burn the Secret on shared browsers or pin it in your Slack channel.
4. Gently correct: When someone shares a password in plain text, kindly suggest using a one-time link next time.

Ready to start sharing passwords securely? Create a secure link on Burn the Secret.