Guide · updated
How to send a password securely
A colleague needs the password to a shared account, a customer needs new login details, your accountant needs an ID number. The quickest way is to type it into an email or a chat – and that is exactly why passwords end up in the wrong hands so often. This page explains why email and chat are the wrong place for secrets, and how to send a password without leaving copies behind.
Why you should not send passwords by email or chat
The problem is usually not that someone reads the message in transit. The problem is that the message stays around in many places, and nobody remembers to delete it:
- In inboxes and sent folders. The password stays readable for years in both the sender's and the recipient's mailbox. If either account is ever compromised, the first thing an attacker searches for is "password" and "login".
- In backups and archives. Even a deleted message can live on in server backups and in the organisation's email archive.
- On every device. Chat and email sync to the phone, the tablet and the work laptop – including the old phone sitting in a drawer.
- In forwarded threads. A message easily travels on with the whole thread, to people the password was never meant for.
A password written in an email is best thought of as public for as long as that email exists anywhere.
Three good ways
1. Two different channels
Split the information and send the parts by different routes: for example the username by email and the password by text message or over the phone. A leak in one channel is then not enough. The same principle works with a self-destructing message: send the link by email and the message's password by text.
2. A self-destructing message
Put the password in a message that is encrypted and destroyed once the recipient has read it. All that remains in the email or chat is a link that no longer opens. If someone opened the link before the right person, the message will not open for the recipient – and you will both know the password must be changed.
3. A password manager
If the same login details are used by several people all the time, the best solution is a shared password manager with a separate folder for shared accounts. For one-off sending – to a customer or a new employee, say – a self-destructing message is simpler.
Why a one-time link can be used up before the recipient opens it
Some email and chat security services open the links in messages in advance to check them, and messaging apps fetch a preview from the link. If a self-destructing message is destroyed as soon as its page loads, the scanner "reads" it first, and the recipient is told the message has already been read.
In Yksityisviesti, loading the page does not use up the message. It is opened only when the recipient presses Show message. The message ID and the key are also in the part of the link after the # sign, which browsers do not send to the server, so scanners and proxies only see the page address.
How to send a password with Yksityisviesti
- Type or paste the password into the message field.
- Choose how long the message waits to be opened and whether it is deleted as soon as it is read. Add a password to sensitive messages.
- Send the link to the recipient by email or chat, and the message's password by a different route, such as a text message.
- Your own browser shows you when the message was opened. A message that has been read is deleted from the server.
The message is encrypted on your device before it is sent, and the key travels only in the link. We cannot see what the message says. What does end-to-end encryption mean?
Also remember
- Change temporary passwords. If you send a new user their first password, ask them to change it the first time they log in.
- Don't send everything together. The service address, username and password in one message are a ready-made package for whoever finds it.
- Devices are always a risk. No encryption helps if the sender's or recipient's own device is infected with malware, or if the recipient takes a screenshot of the message.