You need to send someone a password. Maybe it's a WiFi login for a new hire, an API key for a contractor, or a client's tax portal credentials. You open Slack, type it out, and hit send.
That password now sits in the conversation. Depending on the service's retention, export, and backup settings, it can stay accessible longer, and to more people, than you meant.
Email is similar. The message sits in your sent folder and their inbox under whatever retention and backup rules apply to each mailbox.
Why chat and email are a poor place to leave a password
The tools we use every day were built for communication, not for holding secrets. They keep messages so people can find them later. That's the feature, and it's the problem when the message is a credential.
Deleting the message doesn't reliably remove it. Retention settings, exports, and backups can all keep a copy, and you don't control the other person's mailbox.
How a one-time link changes the handoff
Paste the password into a tool that encrypts it and gives you a link. Send the link. The recipient opens it once, and the hosted copy is deleted.
What's left in the conversation is a link that no longer works, instead of the password itself. That reduces the hosted copies left behind after the handoff.
It doesn't change what the recipient can do. They can copy or screenshot what they see. And the note delivers a credential; it doesn't revoke one.
What makes a secure password sharing tool worth using
Not all one-time link tools are the same. The ones worth using have a few things in common:
- Client-side encryption — the content is encrypted in your browser before it reaches a server. The server never sees the plaintext.
- The key stays in the link — the decryption key lives in the part of the URL your browser doesn't send to the server, so the company running the tool can't read your note.
- Plain about logs — no application logs of who opened what, and a clear statement about what the hosting provider keeps.
- No account required — you should be able to share a password in 10 seconds without signing up for anything.
Gliiph does all four. It's free, it's encrypted in your browser, and it takes about 10 seconds.
If a password may already be exposed
If a credential may have been exposed, rotate or revoke it. Deleting the message alone doesn't invalidate it.
Then change the habit. Next time you need to send a credential, take 10 seconds to create a one-time link instead. Fewer copies left behind, and one less thing sitting in a thread.