You need to give a coworker the Wi-Fi password, or a family member a login. So you paste it into a chat — where it now lives forever, in two accounts, readable by anyone who ever gets into either. Here’s how to hand someone a secret without leaving a permanent copy lying around.
Short answer: Never put the secret and the way to read it in the same message. Either split them across two channels (send the login by chat, the password by phone) or encrypt the secret with Encrypt Text and share the passphrase separately.
Why email and chat are the wrong tools
A password in an email or a chat message isn’t a fleeting thing — it’s a permanent record:
- It’s stored on servers you don’t control, often unencrypted at rest.
- It gets forwarded, quoted, and screenshotted, multiplying the copies.
- It lingers in both mailboxes for years, long after anyone needs it.
The risk isn’t usually someone snooping in transit — it’s that months later, an old inbox gets breached and your password is sitting there in plain text, still valid.
The core idea: split the secret from the key
Every safe method below is really the same move — don’t let one intercepted message contain everything. Give someone the locked box by one route and the key by another. An attacker then has to break into two channels at the same time, which is dramatically harder than reading a single message.
Three ways to do it, better to best
1. Two channels, no encryption. Send the username by email; say the password out loud on a call or send it by text. Simple, and already far better than one message with both. The weakness: the password still exists as plain text on whichever channel carried it.
2. Encrypt it, share the passphrase separately. Turn the secret into ciphertext with Encrypt Text — it scrambles the message in your browser using a passphrase, so the result is meaningless on its own. Send that ciphertext anywhere you like (even the “unsafe” email), then give the passphrase by a different route. Now both pieces are needed, and the encrypted copy that lingers in an inbox reveals nothing.
3. Encrypt and set it to be used once. For the highest-stakes secrets, combine encryption with a short life: share it, confirm the person opened it, and rotate the password afterward. Treat the shared credential as temporary by design.
Make the password worth protecting
Sharing safely is wasted effort if the password itself is summer2024. If you’re handing over a credential — especially one several people will use — generate a strong, unique one first with the Password Generator. A long random password is exactly the kind of thing worth the two-channel treatment; a weak reused one is a problem no delivery method can fix. The how strong is your password guide covers what actually makes one hard to crack.
Handing off in person
If you’re giving Wi-Fi to a guest face to face, a QR code is a clean option — phones can join a network by scanning one, so nobody reads the password aloud or types it wrong. Generate it privately (the code is built in your browser, not uploaded), and remember the flip side: a code stuck on a wall is readable by anyone who walks past, so it suits guest Wi-Fi, not your bank login. The are QR codes safe guide covers when to trust them.
The one rule to remember
Secret and key travel apart. Whether you split channels or encrypt, never let a single message be the whole answer. Do that, and the copy that inevitably gets left behind in someone’s inbox is just noise.