Why sending plain text is risky
A password sent by messenger, text or email stays as-is in chat logs, screenshots and backups. If you lose the device or the chat room leaks, the password leaks with it.
Another problem is that after sharing, it's often left in place, making it hard to control who can access it.
Safe ways to share
We recommend the following methods.
- Use your password manager's sharing feature (encrypted, with permissions and revocable)
- Use a one-time secure note service that disappears once opened
- Rather than handing over the whole account password, grant access through the service's invite or member features
Managing after sharing
Wrapping up the sharing matters.
- Change the password immediately once sharing is no longer needed
- Share only minimally, with people who truly need it
- Apply two-factor authentication to shared accounts as well
Never do this
Avoid the following.
- Sending a password in plain text over chat or email
- Leaving it on a sticky note, a memo app or a document
- Multiple people reusing the same password all over the place