Stop pasting passwords into chat. Here's what to do instead
Somebody needs the Wi-Fi password, the staging database login, or the code for the side door. The quickest move is to paste it into whatever chat window is already open. Done in five seconds.
The trouble is that the message doesn’t go away once it has done its job.
Where a pasted password ends up
A credential sent through a normal chat or email doesn’t live in one place. It lives in:
- Both people’s message history, often synced to every device they own.
- Server-side archives and backups, sometimes kept for years for compliance.
- Search indexes. Type “password” into your workspace search and see what comes back.
- Notification previews on lock screens and smartwatches.
- Exports and integrations: bots, connected apps, and the archive someone downloads when they leave the company.
Each copy is another place an attacker can find it later. Most account takeovers don’t involve clever cryptanalysis. Someone simply finds a credential where it was left.
A better routine in four steps
1. Send the secret through something that forgets
Use a one-time link that is destroyed after it’s opened. The secret is readable exactly once, by the person who needs it. Your chat history keeps only a dead link.
2. Split the secret from its context
Don’t send “here’s the admin password for the billing server: …” in a single message. If the link travels by chat, mention what it’s for in a different conversation, or not at all. A secret with no label is far less useful to whoever stumbles on it.
3. Add a password for anything important, and send it another way
For high-value secrets, protect the note with a password and share the password over a different channel: say it on a call, or send it by SMS if the link went by email. An attacker then needs access to two separate channels instead of one.
4. Rotate after sharing
If a credential is shared with someone temporarily, such as a contractor, a support session, or a one-off login, change it once they’re done. The safest shared secret is one that has stopped working.
What if the link was already opened?
If your recipient opens the link and is told the note has already been read, take it seriously. Someone else got there first, whether a person, an over-eager security scanner, or someone with access to the conversation. Assume the secret is exposed and change it.
That warning is the point of the exercise. A password pasted into chat can be read a thousand times and nobody ever knows. A self-destructing note tells you when something has gone wrong.
The five-second version
Next time someone asks for a password: write it into a self-destructing note, send the link, and, if it matters, send a password for the note separately. It takes about as long as pasting, and it doesn’t leave a copy in your chat history.