How to Share Client Passwords Securely Without Email
Stop emailing passwords to clients. Learn the secure alternatives that protect both you and your clients from data breaches and compliance violations.
Persay Team
Author
You know it’s wrong to email passwords to clients. But what’s the alternative? Here’s the reality: every day, thousands of professionals email login credentials, API keys, and access codes—creating a trail of unencrypted data that never truly disappears.
Why Email Is the Worst Way to Share Passwords
The Three Fatal Flaws
1. Email Is Not Encrypted
Most email travels in plain text. Even when encrypted in transit, it sits unencrypted on servers:
- Your mail server
- Their mail server
- Any mail server in between
- Both of your backup systems
- Mobile device caches
2. Email Lives Forever
That password you sent last year? It’s still sitting in:
- Your sent folder
- Their inbox
- Deleted items (not really deleted)
- Email backups
- Mobile phone archives
- Email provider’s disaster recovery systems
3. Email Gets Forwarded
Clients forward emails without thinking:
- To assistants
- To IT departments
- To their whole team
- To new employees years later
Real Consequences
A data breach at an accounting firm traced back to a password emailed three years earlier. The client had forwarded it to their CFO, who saved it in an unencrypted notes app that was later compromised.
The Right Way: Secure Alternatives
Option 1: Password Managers with Secure Sharing
How It Works:
- You store the password in your password manager
- Generate a secure sharing link
- Share the link (which expires)
- Client accepts and saves to their password manager
Recommended Tools:
- 1Password - Share via secure links that expire
- Bitwarden Send - Self-destructing password shares
- Dashlane - Encrypted password sharing for individuals
Pros:
- Encrypted end-to-end
- Time-limited access
- No permanent copies
- Works with free accounts
When to Use: This works best for one-off password shares with tech-savvy clients.
Option 2: Client Portals with Credential Storage
How It Works:
- Client logs into their secure portal
- You store their passwords in their portal vault
- They access when needed
- You can update without re-sharing
Solutions:
- Persay - Built-in credential vault for each client
- SmartVault - File sharing plus password storage
- SecureSafe - Swiss-based secure storage
Pros:
- Centralized access
- Update credentials without notifying clients
- Audit trail of who accessed what
- Professional client experience
When to Use: Best for ongoing client relationships where you regularly need to share access credentials.
Option 3: Single-Use Secret Links
How It Works:
- Paste password into secure service
- Generate one-time link
- Send link separately from context
- Link destroys after first view
Services:
- OneTimeSecret.com - Free, simple, reliable
- PrivateBin - Open source, self-hostable
- Yopass - Encrypted, self-destructing secrets
Pros:
- Free and simple
- No account needed
- Truly disappears after use
- Works for any text secret
Cons:
- No audit trail
- Easy to accidentally burn the link
- Requires explaining to clients
When to Use: Quick shares of temporary passwords or one-time codes.
Step-by-Step: Switching from Email
- 1
Choose Your Method
Pick the approach that fits your client relationship type and frequency of sharing.
- 2
Set Up Your Tool
Create accounts and test the workflow yourself before involving clients.
- 3
Prepare Your Explanation
Clients need to know WHY you're changing. Frame it as protecting THEIR security.
- 4
Send Instructions First
Don't make them figure it out. Send clear, simple instructions with screenshots.
- 5
Share the First Password
Walk through it together on a call if needed. The first time is always hardest.
- 6
Clean Up Old Emails
Ask clients to delete old password emails. Do the same on your end.
What to Say to Clients
The Email Template
Subject: Important Security Update for Your Account Access
Hi [Client Name],
I'm upgrading how I share sensitive information with you to better protect your business.
Going forward, I'll be using [Tool Name] to securely share passwords and access credentials instead of email. This means:
✓ Passwords are encrypted end-to-end
✓ Access automatically expires
✓ No permanent copies in email archives
✓ You control who can access the information
I've created a quick guide (attached) that walks you through accessing your first shared credential. It takes about 2 minutes to set up.
Your security is my priority. Thanks for taking this extra step with me.
Best,
[Your Name]The Call Script
“I wanted to let you know I’m changing how I share passwords with you. I used to email them, but that’s not actually secure—emails sit on servers unencrypted forever. I’m switching to [method] which encrypts everything and only you can access it. It’s really quick to set up. Can I walk you through it now?”
Industry-Specific Scenarios
For Accountants
What You’re Sharing:
- Tax software logins
- Bank portal access
- Accounting system credentials
- IRS e-services access
Extra Considerations:
- IRS Publication 4557 requires reasonable security
- Many states have data breach notification laws
- Professional liability insurance may require secure practices
Recommended: Client portal with credential vault. You need audit trails for compliance.
For Web Developers
What You’re Sharing:
- Hosting credentials
- CMS admin access
- FTP/SFTP passwords
- API keys
Extra Considerations:
- Clients may need ongoing access
- Credentials change during development
- Multiple team members may need access
Recommended: Password manager with team sharing or client portal.
For Healthcare Consultants
What You’re Sharing:
- EHR system access
- HIPAA-compliant portal credentials
- Telehealth platform logins
Extra Considerations:
- HIPAA requires encryption of ePHI
- Business Associate Agreements may specify security methods
- Audit trails are legally required
Recommended: HIPAA-compliant client portal only. Email is completely prohibited.
For Legal Professionals
What You’re Sharing:
- Legal research logins
- Court filing system access
- Document management credentials
Extra Considerations:
- Attorney-client privilege doesn’t protect insecure communication
- Bar associations have cyber security requirements
- Malpractice claims increasingly include data breaches
Recommended: Encrypted client portal with documented security policies.
Common Client Objections (And How to Handle Them)
“Email has always worked fine”
Response: “Email seems fine until there’s a breach. I’d rather prevent a problem than explain to you later why I didn’t protect your access properly. This takes 5 minutes to set up and works better than email anyway."
"This seems complicated”
Response: “I thought that too, but it’s actually simpler once you’re set up. Instead of digging through emails, everything is in one place. Let me show you—it’s really just clicking a link."
"I don’t want another account to manage”
Response: “I get it. The good news is [tool] can save your login, so you only authenticate once. And you’re not managing passwords—I’m storing them for you securely. You’re just retrieving them when needed."
"Can you just text it to me?”
Response: “Text messages aren’t encrypted and live forever on phone backups. I can send you a secure link via text that works once and disappears. That’s actually even easier than copying from a text message.”
The Two-Message Rule
Never send both the password AND the context in the same message.
Bad:
“Here’s your password for the client portal: xK9mP2$vL”
Better:
Message 1 (email): “I’ve set up your client portal. Use your business email as username.” Message 2 (secure link): “xK9mP2$vL”
Even better: Let them set their own password through a secure reset flow.
Audit Your Current Practices
Before you change anything, assess the damage:
- 1
Search Your Sent Email
Search for 'password', 'credentials', 'login', 'username'. How many did you find?
- 2
Check Client Documentation
Do you have shared documents or spreadsheets with passwords?
- 3
Review Chat Apps
Have you sent passwords via Slack, Teams, or WhatsApp?
- 4
Calculate Your Exposure
Count: clients × passwords shared × months they've existed.
If you found more than 5 passwords in insecure locations, it’s time to fix this today.
Quick Start: Your First Secure Share
If you need to share a password TODAY:
- Go to OneTimeSecret.com
- Paste the password
- Set it to expire in 7 days or after 1 view
- Copy the link
- Send link to client (separate from any context about what it’s for)
- Confirm they retrieved it
- Note that you used a secure method in your files
This week:
- Choose a permanent solution based on your client relationship type
- Set up an account
- Test the workflow yourself
- Document instructions for clients
- Send your first secure share
This month:
- Migrate all active clients to secure sharing
- Ask clients to delete old password emails
- Delete password emails from your sent folder
- Update your client onboarding process
- Add “secure credential sharing” to your service agreements
Conclusion
Every password you email is a potential breach waiting to happen. The solution isn’t complex—it’s just different from what you’re used to.
Choose one method today. Set it up. Share your next password the right way. Your clients might not thank you (they don’t know what you’re protecting them from), but their data will be safer because of your choice.
Stop emailing passwords. Start today.