How to send a password safely, and what not to do
A password sent in Messenger, email or Viber stays in both chats until deleted, so use a password manager's sharing or a link that expires after one view.
UB Web Developers team
Don't send a password as a plain message in Messenger, email or Viber: an ordinary message stays readable on both sides until it is deleted there, and anyone who gets into either account can find it. Use a password manager's sharing feature, or a link that opens once and then expires.
If a password has already gone out in a chat, change it once the other person has used it.
Why does a password sent by chat or email stay readable?#
The encryption in these apps protects a message on its way between devices. Once it sits in a chat or an inbox, anyone who can open that account or an unlocked phone can read it.
- Email. Gmail encrypts messages "while they are in transit" (Google (opens in new tab)). After delivery the email sits in your Sent folder and in the recipient's inbox until each of you deletes it. Deleted Gmail messages then stay in Trash for 30 days unless you empty it sooner (Google (opens in new tab)).
- Messenger. In December 2023 Meta started rolling out default end-to-end encryption for personal Messenger chats, so "nobody, including Meta, can see what's sent or said" unless you report a message to Meta (Meta (opens in new tab)). The chat history is kept, and on a new device you restore it with a recovery method such as a PIN. A password in that history can be read by anyone who picks up your unlocked phone, or gets into the account and its recovery method.
- Viber. Viber also uses end-to-end encryption by default and says nothing is kept on its servers once delivered (Viber (opens in new tab)). An ordinary message stays in the chat on both phones until it is deleted. Viber lets you delete a sent message for everyone, even after it was seen, but the other person may already have copied it.
So the risk isn't someone reading the message on its way. It is someone who gets into one of the accounts, or picks up an unlocked phone, months later. Taken-over accounts are common: our guide to a hacked Facebook business page covers recent campaigns that hit thousands of them.
What should I avoid?#
- Sending the website, username and password together in one message. That gives anyone who reads it everything they need.
- Sending a screenshot of a password. It is the same password, now saved in your photos as well.
- Keeping a shared password once the job is done. Google's advice when you stop sharing an account is to change the password (Google (opens in new tab)).
- Sending two-factor codes or backup codes to anyone. Google's advice for backup codes is "Do not share your backup codes with anyone" (Google (opens in new tab)).
What are the safer ways to share a password?#
A password manager. The UK's National Cyber Security Centre recommends (opens in new tab) them. They create a strong, different password for each account, fill it in only on the correct website, and many can share a password. Three examples, each working differently:
- Google Password Manager shares a password only with members of your Google family group. The password is saved in their Google Account (Google (opens in new tab)).
- 1Password makes a link to a copy of an item. The recipient doesn't need a 1Password account, you choose when the link expires, and you can limit it to specific email addresses (1Password (opens in new tab)).
- Bitwarden Send makes a temporary link to text or a file. It is encrypted when you create it, can have a password and a limit on how many times it opens, and is deleted after at most 31 days (Bitwarden (opens in new tab)).
A one-time link. A link that opens once and then expires leaves nothing readable behind in the chat you paste it into.
Disappearing messages, as a last resort. If you must use a chat, turn on disappearing messages first. On Messenger they last 24 hours (opens in new tab), and on Viber the message is deleted from the chat after it is read (Viber (opens in new tab)). The other person can still copy it before it goes.
How do our secure sending pages work?#
We have two pages for this. Here is what each one does, taken from its code.
Sending a password to UB Web Developers#
/share-secret is a one-way drop box: anyone can use it to send a password to our team, without an account.
- Where it is encrypted. In your browser, before anything is sent. The page locks your text with a new random key (AES-256-GCM), then locks that key with our public key (RSA-OAEP, 4096-bit).
- What the server stores. The encrypted text and the locked key. The two optional fields, your name and what the password is for, are stored as plain text, so don't put the password in them.
- Who can open it. The matching private key is kept in a server setting, not in the database, so a copy of the database alone can't be read. When someone on our team opens the submission in the admin inbox, our server decrypts it and shows it to them.
- How long it lasts. It is marked as read when opened, not deleted. After 30 days the inbox no longer shows or opens it. Our team can also delete it.
- What we're told. An email saying a submission arrived, with only the name, the label and the time.
Sending a secret to another account#
/tools/secret makes a one-time link. Both people need an account on our site, and only the account the sender chooses can open the link.
- Where it is encrypted. In the sender's browser. The key goes into the link after the # sign. Browsers don't send that part to the server, so the server stores the secret only as encrypted text, next to who sent it, who can open it and its label.
- How long it lasts. The sender chooses 1 hour, 1 day or 7 days.
- What happens when it opens. The page removes the key from the address bar as soon as it loads. The secret shows only when the chosen account selects Reveal secret, and that one view erases the encrypted text from the database. The link's record stays, without the text, so a second visit shows that the secret is gone.
Links our team sends from its own command-line tool work slightly differently. The key isn't in the link: it is locked to a server key, and the server releases it only when the one view is used, then erases it with the encrypted text.
None of this protects a password after the recipient has read it. If they paste it into a chat, it is back where it started.
Sources#
- Google, Learn how Gmail encrypts your emails (opens in new tab), Gmail Help
- Google, Delete messages in Gmail (opens in new tab), Gmail Help
- Google, Manage passwords in Chrome (opens in new tab), Google Account Help
- Google, Sign in with backup codes (opens in new tab), Google Account Help
- Loredana Crisan, Launching default end-to-end encryption on Messenger (opens in new tab), Meta, 6 December 2023
- Viber, Security (opens in new tab)
- National Cyber Security Centre, Managing your passwords (opens in new tab), updated 21 May 2026
- 1Password, Securely share 1Password items with anyone (opens in new tab), 3 August 2026
- Bitwarden, About Send (opens in new tab)
Frequently asked questions#
Is it safe to send a password on Messenger now that it is end-to-end encrypted?#
Safer in transit, but it still stays in the chat. In December 2023 Meta started rolling out default end-to-end encryption (opens in new tab) for personal chats, so Meta can't read them unless someone reports a message. The password still sits in the chat history on both sides, and anyone who picks up either unlocked phone, or signs in to either account and restores its history, can scroll up and read it.
Is it OK to email a password if I delete the email afterwards?#
Deleting your copy doesn't delete the recipient's. In Gmail, deleted messages also stay in Trash for 30 days (opens in new tab) unless you empty it sooner. If a password has been sent by email, change it once the recipient has used it.
Can UB Web Developers read what I send through /share-secret?#
Yes, that is what the page is for: it sends a password to our team. Your browser encrypts it before sending, the database stores the password only in encrypted form, and it is decrypted on our server when someone on our team opens it in the admin inbox.
How long does a one-time link last?#
It depends on the tool. On our /tools/secret page the sender chooses 1 hour, 1 day or 7 days, and the link stops working after one view. A Bitwarden Send (opens in new tab) is deleted after at most 31 days.