How to share passwords securely: five options

Why the email with the password is the problem

An email sits in sent items, in the inbox, on every device that syncs the mailbox, in backups and sometimes in a forward to a private address. Whoever gets hold of any of these has the password, often years later. If the username is in the same email, the package is complete.

Five options

Five rules for IT

1. Never send a username and password together in plain text.
2. Initial passwords are single-use: change them at first sign-in.
3. Passwords do not belong in tickets, chats or notes.
4. Anyone who calls and asks for a password gets a call-back on the known number.
5. Shared passwords have an owner and are changed when someone leaves.

How a one-time link works

You enter the password in a form and get a link. The recipient opens it and sees the password once. After that the content is deleted, for you too. If nobody opens the link, it deletes itself after a fixed time. The email contains only the link, so nothing usable stays in the mailbox.

The catch: whoever opens the link first sees the password. If the right person finds the link already opened, they know something is wrong and get in touch. In that case, replace the password and investigate. And here too, always have the initial password changed at first sign-in.

Subject: Your access from [date]

Hi [first name],

Your username is [first.last@company.example].
Your initial password is behind this link:
[one-time link]

The link works exactly once and for 24 hours at most.
Please open it only when you are ready to sign in.
You will be asked to choose a new password at first sign-in.

Already opened or expired? Call us on [phone number].

[Name], IT

Shared and external access

Printer administration, the guest Wi-Fi password and supplier portal access are not one-time passwords. Keep them in a password manager with controlled sharing, so you can see who knows them and which ones to change when someone leaves the company.

Service providers, consultants and partners sometimes need access as well. Give them named accounts of their own rather than shared ones, with an expiry date, and send the credentials like an initial password: separate from the username, or as a one-time link. When the engagement ends, block the account instead of just changing the password. A list of external access makes it easy to find them again at the next tidy-up.

When someone calls and wants a password reset

The classic attack on an internal IT team is the phone call: “I’m out on a job, my password isn’t working, can you reset it quickly?” The voice sounds familiar and it is urgent. Set a simple rule and stick to it, even with people you know: call back on the known number from the directory, not on the number the call came from. Or ask the person’s manager to confirm.

1. Check identity: call back on the known number, or in person.
2. Reset the password and set “change at next sign-in”.
3. Send the new password by a separate route, for example as a one-time link.
4. Record in the ticket that the password was reset and how, without the password.
5. If you suspect misuse, end sessions and check sign-ins.

If sign-in needs a second factor, such as a code from an app, an intercepted password is no longer enough on its own. That is no reason to send passwords carelessly, but it is a reason to switch on multi-factor authentication for everyone who connects from outside. Resetting the multi-factor method needs the same check as resetting the password, if anything a stricter one.

1. IT will never ask for your password.
2. Initial passwords come in person or as a one-time link
   and are changed at first sign-in.
3. Passwords are not shared by email, chat or ticket.
4. Anyone who asks for a password reset is called back
   on a known number.
5. Shared access is kept in the password manager.

Common mistakes

• A password in the email subject, to make it quicker.
• The same initial password for every new starter, for years.
• A password in a ticket, “just briefly, I will delete it later”.
• A screenshot of the password in a chat.
• A note stuck to the monitor on a shared PC.

Each of these mistakes is convenient and understandable. The alternatives are hardly more effort once they are in place. A rule of thumb for the team: passwords travel once, by a route of their own, and are changed afterwards. If everyone in IT knows this sentence and acts on it, most of the work is done. Hang it up where access is granted.

One-time links straight from the ticket

IT most often needs a one-time link right where the ticket is: for a new starter, visitor Wi-Fi or a reset password. In 404desk, you create the link in the ticket. It is valid for 24 hours at most and shows the password exactly once. The password is not stored in the ticket itself. The audit log records that a link was created and opened. See one-time links.