How to send passwords securely via email

    Do not put the password in the email. Email a link that reveals it once, then burns.

    Step by step

    1. 1

      Decide what the email will carry

      The email carries the context: what the login is for, the username, and where to sign in. The password itself goes somewhere the email cannot keep it.

    2. 2

      Create a one-time link for the password

      Paste the password into the creator below. Your browser encrypts it before it is sent, and the link burns after the first view.

    3. 3

      Paste the link into the email and send

      A link in an email is fine, because the link is only useful once. Tell the recipient to open it now and store the password in their own manager.

    4. 4

      Confirm it was opened by the right person

      If they say the link was already burned, someone else got there first. Change the password and send a new link. On Pro, the audit timeline shows when each view happened.

    Send it with a one-time link

    0/10,000 characters

    Passphrase protection is available on Pro ($29/mo). See plans

    Burn after read is always on for anonymous secrets. The link self-destructs after one view.
    Burn after read
    Encrypted in your browser
    Never expires (until read)

    No account needed. Free forever plan.

    How it works

    1. 01

      Paste a password, a key, or a file

      Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.

    2. 02

      Send the link

      One URL. The key after the # stays in the browser and never reaches our servers.

    3. 03

      The stored secret is gone

      The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.

    Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model.

    Is it safe to send passwords over email?

    Not as plain text. An email is stored on your mail server, the recipient's, every backup of both, and every device either of you signs in from. It is searchable for years and forwards with one click. Transport encryption between servers protects the message in flight, not at rest in a dozen mailboxes.

    Gmail and Outlook both offer extra protection. Gmail's confidential mode can set an expiry and block forwarding, and Google Workspace customers can use S/MIME. Outlook can encrypt a message with Microsoft 365 Message Encryption or S/MIME. These help, with two limits: the password still sits in the recipient's mailbox for as long as the message does, and the recipient often needs the same provider or a certificate for it to work.

    Sending passwords via email with a one-time link

    A one-time link turns the problem around. The email carries no password, only a URL. The password is encrypted in your browser with AES-GCM-256, the key stays in the link after the #, and the first reveal destroys the stored copy. If the email is found a year from now, the link in it leads to a burned page. No shared provider, no certificate, and nothing to install on the recipient's side.

    For Outlook specifically, including Outlook's own encryption options, see how to send passwords securely via email in Outlook.

    Send password via email: what to write

    Keep it short. Name the system, give the username, paste the link, and say that it opens once. If you add a passphrase on Pro, send it by phone or text rather than in the same email, so the email alone is never enough.

    Frequently asked questions

    Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans.

    Related

    All use cases