Why You Should Never Send Passwords Over WhatsApp or Email

The dangerous moment is not the second you hit send. It is the next morning, when the password is still sitting in the thread and someone forwards the chat "for context."

People send passwords this way because it is fast. The Netflix login for a guest, the office Wi-Fi, the shared mailbox your cousin needs this once. The fear underneath the habit is reasonable: if that string leaks, someone else can log in as you. Chat and email are built to keep messages, which is the opposite of what a password needs.

What actually happens to a password in a chat

WhatsApp encrypts messages between the sender's phone and the recipient's phone. That protects the text from a stranger listening on the network. It does nothing about the person holding the unlocked phone.

Once the message arrives, it is ordinary text on their screen. They can:

• Screenshot it and drop it in another group
• Forward the message, password included
• Leave the phone on the table while the chat is open
• Back the chat up to the cloud

A backup is a second copy. WhatsApp can lock backups with their own password, and plenty of people never turn that on. A normal cloud backup is then protected by the cloud account, which is a different — and often weaker — lock than the chat itself. "Delete for everyone" is a request with a time window. It has never once deleted a screenshot.

So the pipe can be private and the password can still be loose. Those are different problems.

Email is the copy that never expires

Email is worse for this job, because it was designed as a filing cabinet.

The message lands on a mail server. Your Sent folder keeps a copy. Their inbox keeps a copy. Forward sends both, plus the password, to whoever is next. Most personal email is not end-to-end encrypted, which means the provider's systems can read it — that is how spam filtering works — and a broken-into mailbox exposes the whole history.

If you have ever emailed yourself a password "so I don't lose it," that string is now as durable as the account. When mailboxes show up in public breaches, old messages come with them. Have I Been Pwned is the quick way to see whether an address has already appeared in one. A password that was also your bank login, your email login, and the Wi-Fi note from 2022 fails everywhere at once.

CISA's guidance on strong passwords is blunt about the fix that actually matters: a different long password for every account, stored in a password manager, with the one passphrase you memorize reserved for the manager itself. Reuse is the multiplier. The chat leak hurts in proportion to how many doors that same string opens.

The safe way to share a password

Pick the method from how long the other person needs it.

They will keep using it. A password manager that can share a login is the calm option. They get the password inside the manager, you can revoke the share later, and the group chat stays empty of secrets. Generate the password first so it is unique to that account — the Password Generator does this in the browser, with nothing uploaded. What "strong" actually means, including the passphrase you should be able to remember for the manager itself, is in What Is a Strong Password?.

They need it once. Lock the password inside a note and send only the scrambled text. On the Secret Message Encryptor, choose Lock message, paste the password (and a one-line label so they know what it opens), and copy the block into the chat. Then call them, or tell them in person, the short phrase that unlocks it. The thread can be forwarded all day. Without that phrase it is gibberish.

You are standing next to them. Read it aloud, or let their phone join the Wi-Fi from yours. A password that was never typed into a chat cannot be scrolled back to in six months.

The full send-and-unlock habit — separate channel for the phrase, entire block pasted, no recovery if the phrase is lost — is How to Send a Secret Message to Someone (Without Any App).

What I would actually do

For anything that opens money, mail, or a work account, I want a manager share or a locked note plus a phone call. I would rather say twelve characters out loud than leave them in a thread that outlives the reason I sent them.

A few habits make the handoff smaller even when you are in a hurry:

• One password, one account. The guest login is not your login.
• Put a label in the locked note ("office Wi-Fi") so the scrambled block is not a mystery they try to crack with the wrong phrase.
• After they have saved it, there is nothing you need to "clean up" in the chat, because the plaintext was never there.
• Turn on a second step — a code or a prompt — anywhere the account allows it. A leaked password then opens one less door.

Sharing a password securely is mostly a refusal to let the convenient app become the storage. Generate a unique one. Deliver it through a manager, or lock it and speak the key. Let the chat keep the logistics.