The Right (and Wrong) Way to Share Passwords with Coworkers

In a fast-paced work environment, it’s tempting to just “DM” a password to a teammate on Slack or shoot it over in an email. However, these methods leave a permanent, unencrypted trail of your most sensitive credentials. If a hacker gains access to your chat history, they have the keys to everything.

Why Slack and Email are “Wrong” for Passwords

• Persistence: Messages stay in the history forever unless manually deleted.
• Lack of Zero-Knowledge: While encrypted in transit, the service provider (or anyone with admin access) could technically view your messages.
• The “Search” Factor: Hackers specifically search for keywords like “password,” “login,” and “credentials” once they breach a workspace.

The “Right” Way: Zero-Knowledge Sharing

The safest way to share a password is to ensure that the platform itself cannot read the data. This is known as “Zero-Knowledge” encryption.

Secure Sharing Checklist:

1. Use a Dedicated Manager: Tools like Bitwarden or 1Password allow you to create “Collections” or “Vaults” shared with specific teammates.
2. Use Self-Destructing Links: If you don’t use a shared manager, use a Secret Note Generator. The password disappears as soon as your coworker reads it.
3. The Two-Channel Rule: Never send the username and password in the same place. Send the username via Slack and the encrypted password link via a different app.
4. Rotate Regularly: Even if you share a password securely, change it immediately if a team member leaves the company.