How to Send Passwords Securely Over Email

Why Emailing Passwords Is Dangerous

When you type a password into an email and hit send, that password now exists in at least four places: your sent folder, the recipient inbox, your email server, and the recipient email server. If either account uses IMAP, add every synced device to that list.

Emails are stored indefinitely by default. That password you emailed six months ago is still sitting in both inboxes, fully readable. If either email account is ever compromised, the attacker gets every password ever shared through email.

The Safe Way: One-Time Links in Emails

Instead of putting the actual password in the email body, replace it with an encrypted one-time link. The workflow is simple:

1. Go to onetimelink.me and paste the password.
2. Copy the generated encrypted link.
3. Paste the link into your email instead of the actual password.
4. The recipient clicks the link, sees the password, and the link self-destructs.

Now the email only contains a link — not the password itself. After the link is opened, the email is harmless. An attacker who gains access to the email account later finds a dead link that reveals nothing.

Step-by-Step: Sending a Password Over Email Safely

Step 1: Create the encrypted link

Open onetimelink.me in your browser. Paste the password, API key, or credential into the text field. Optionally set a short expiration time (15 minutes is usually enough for email) and add a passphrase for extra protection.

Step 2: Copy the link

Click the copy button to copy the one-time link to your clipboard. The password is now encrypted — the key is embedded in the link itself and never touches the server.

Step 3: Compose your email

Write your email and paste the link where you would normally paste the password. For extra security, do not mention what the link contains in the same email. Just say something like: "Here is the access you requested" followed by the link.

Step 4: Tell them what it is via a different channel

Send a quick message on Slack, Teams, or text: "Check your email — I sent you the staging password." This way, neither channel has enough context on its own.

Common Objections (and Why They Are Wrong)

"But my email uses TLS"

TLS encrypts the email in transit — while it travels between servers. It doesnot encrypt the email at rest. Your password sits in plaintext on the mail server, in the inbox, and in backups. TLS protects against eavesdropping on the wire but not against account compromise.

"I will just delete the email after"

Deleting an email removes it from your view. It does not remove it from server backups, the recipient inbox, or any compliance archives your company might have. And you are trusting the recipient to delete it too.

"It is just an internal password, not that important"

Internal credentials are often the most valuable to attackers. A shared staging password that has not been rotated in months is a common entry point for lateral movement in breaches.

What About Password-Protected ZIP Files?

Some people send passwords inside encrypted ZIP files attached to emails, then send the ZIP password in a separate message. This is better than plaintext but still flawed: the ZIP file persists in the email forever, and the encryption on older ZIP formats is weak. One-time links are simpler and more secure.