Every IT team has seen it: a password pasted into an email, a Slack DM or a text. The message sits in inboxes, backups and search indexes long after the password was needed. If either account is ever compromised, so is the password.
The fix is simple. Send a link that expires instead of the password itself.
Our first choice: share it from 1Password
Advisory is a 1Password partner, and it is how we share credentials today. If the password already lives in your 1Password vault, there is no reason to copy it anywhere else. 1Password lets you share an item with anyone through a secure link, even if they do not have a 1Password account.
- You choose when the link expires.
- You can limit the link to specific email addresses; recipients then verify their email before the item opens.
- On 1Password Business, admins control who can share and with whom.
- The password stays in your vault, so you can change it later in one place.
When the secret is not in your vault: a one-time link
Sometimes you need to send something that does not belong in your password manager, such as a one-off code or a temporary credential from a vendor. For those, we use one of two free services that delete the secret after it is viewed or after it expires.
One-Time Secret has been running since 2012. You paste the secret and get a link that opens once; after that, the secret is deleted.
- Without an account, links expire after up to 7 days. With a free account, up to 14 days, and you can delete ("burn") a secret before it is read.
- You can add a passphrase.
- The code is open source.
Password Pusher works the same way, with a little more control.
- The link expires after a number of views, a number of days, or whichever comes first, for example after 1 view or 3 days.
- You can add a passphrase, and each view is logged.
- The code is open source, and companies can host their own copy.
What we recommend
- Never send a password and its username in the same message. If you add a passphrase, send it through a different channel than the link, for example the link by email and the passphrase by phone.
- Use a shared vault for anything a team uses repeatedly. A link is for one-time handoffs.
- Change the password if the link was sent somewhere you do not control, or if it expired unopened.
- Better still, remove the need to share it: single sign-on and per-user accounts mean fewer shared passwords to hand around.
Need help setting up 1Password or SSO for your team? Talk to our team.