How to send passwords securely via email in Outlook

    Outlook can encrypt the message, but the safer move is to email a link that reveals the password once.

    Step by step

    1. 1

      Write the Outlook email as usual

      Include the system name and the username. Leave the password out of the body and the subject.

    2. 2

      Create a one-time link for the password

      Paste the password into the creator below. It is encrypted in your browser before it is sent, and the link burns after the first view.

    3. 3

      Paste the link into the email

      Add one line: the link opens once, so open it now and save the password in your password manager.

    4. 4

      Send, then check with the recipient

      If they report a burned link before they opened it, rotate the password and send a fresh link. Outlook's Safe Links scanner does not burn the secret; only an explicit reveal does.

    Send it with a one-time link

    0/10,000 characters

    Passphrase protection is available on Pro ($29/mo). See plans

    Burn after read is always on for anonymous secrets. The link self-destructs after one view.
    Burn after read
    Encrypted in your browser
    Never expires (until read)

    No account needed. Free forever plan.

    How it works

    1. 01

      Paste a password, a key, or a file

      Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.

    2. 02

      Send the link

      One URL. The key after the # stays in the browser and never reaches our servers.

    3. 03

      The stored secret is gone

      The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.

    Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model.

    What the Encrypt button in Outlook does for a password

    Outlook for Microsoft 365 has an Encrypt option under the Options tab. It uses Microsoft 365 Message Encryption, which can also stop forwarding, and it works best when the recipient is also on Microsoft 365; other recipients read the message through a web portal after signing in or using a one-time passcode. Outlook can also use S/MIME when both sides have certificates. Either way, the password stays in the mailbox, readable to anyone who later signs in as the recipient, for as long as the message exists.

    Send a password in Outlook with a one-time link

    A one-time link avoids all of that. The email that leaves Outlook contains a URL and nothing sensitive. The password is encrypted on your device with AES-GCM-256, the key lives after the # in the link, and the recipient's first reveal destroys the stored copy. The recipient can be on Gmail, a company server or a phone: any browser opens it, no portal and no passcode.

    The same approach works from the Outlook mobile app, since the link is plain text you paste into the message.

    Combine both when policy requires it

    Some organisations require every external email to be encrypted. In that case use Outlook's Encrypt option as the policy asks and still put the password in a one-time link, so a message that is later read by the wrong person holds a burned link rather than a working credential. For the general picture across providers, see how to send passwords securely via email.

    Frequently asked questions

    Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans.

    Related

    All use cases