Why sending a password in a message is risky
Sooner or later most people need to give someone access to an account: a partner who needs the utility login, a parent who wants help with email, a coworker who has to post to the company social page. The quickest method is to type the password into a text or chat message. It is also one of the riskier ones.
A password sent in a message sits in the chat history, often indefinitely. It can be backed up to a cloud service, shown in a notification on a locked screen, forwarded by accident or read by anyone who gets into either person’s phone. Email is similar. And once a password has been shared this way, you cannot tell who else has seen it.
The goal is to give the access someone needs, in a way you can limit and take back.
Start with the best option: do not share the login at all
Many services have a built-in way to grant access without handing over your password. When it exists, use it.
- Delegate or invite features. Some email and calendar services let you give another person limited access to your mailbox or calendar under their own login.
- Family or household plans. Streaming, storage and software subscriptions often include family groups, where each member has a separate account.
- Role-based accounts at work. Business tools usually let an administrator add a coworker with a defined role, such as “viewer” or “editor.”
- Authorized user options. Banks and card issuers sometimes allow another person to be added to an account with their own card or credentials, rather than sharing yours.
These routes have important advantages. Each person signs in as themselves, so there is a record of who did what. You can change or remove one person’s access without affecting anyone else. And there is no shared secret circulating around.
When a shared login is unavoidable
Some accounts only have one login, such as a household streaming profile, an old social page or a piece of equipment. In that case, share it as carefully as you can.
Use a shared vault in a password manager. Many password managers offer shared folders or family and team plans. The login is stored once, and each person is invited separately. Changes to the password update for everyone, and you can revoke access later. This is the approach most security professionals prefer for shared credentials. The article on what password managers do explains how they protect entries.
If you must send it, do it with care.
- Prefer a manager’s secure-share feature if it has one. Some create a link that expires after a set time or a single view.
- Do not send the password and the username together in the same message.
- Use an app with end-to-end encryption, and consider whether disappearing messages are available.
- Tell the person to change it after the first use, or change it yourself afterward.
- Never post it in a group chat, a shared document or an email thread with many recipients.
Protecting a shared account
A shared account is only as safe as its weakest user, so some extra care is worthwhile.
- Use a strong, unique password. Never one that is also used elsewhere, since the problem of password reuse becomes worse the more people know it.
- Turn on a second step. This is trickier with sharing, because the code goes to one person’s phone. Some services let you register more than one method, or let you share an authenticator seed through a manager. The choices are covered in verification code options.
- Keep the recovery details current. Make sure the recovery email or phone number belongs to someone responsible.
- Review who has access. Every few months, check the list of signed-in devices and remove the ones you do not recognize.
- Limit what the account can do. Avoid linking payment methods to a shared account unless necessary.
At work
Shared passwords in a team are a common weakness. People leave, roles change, and nobody remembers who knows what. For workplace security, the better practice is individual accounts wherever possible, a company-approved shared vault where not, and a rule that credentials are never pasted into chat. Small teams will find this especially relevant; the guidance on small business cybersecurity covers the wider picture.
When someone leaves the team, change any password they knew and review whether they still have access to linked accounts.
When a relationship changes
Sharing access is a trust decision, and trust can change. If you split from a partner, fall out with a friend or a family member moves away, change the passwords you shared and review recovery settings, devices and connected apps. This is an uncomfortable task, but it is easier to do calmly than after something goes wrong. If you are in a controlling or unsafe situation, local support services can help; contact emergency services if someone is in immediate danger.
Helping an older relative
Many families help an older relative with email or banking. It is kind, but handle it carefully. Consider helping them set up a password manager, keeping a list of important accounts in a safe place, and using delegate options where they exist. Be alert to scammers who pretend to be a relative asking for a login, which is a recurring theme in senior scams.
A simple rule
Give access in the narrowest way that works, to the fewest people, for the shortest time. If it can be done without sharing a password, do that. If not, use a tool built for the job, and know how you would take the access back.