How to share a password with a client securely
You set up a hosting account, a CMS admin or a mailbox, and now the client needs the login. Email and chat keep that password forever, in both inboxes, in backups and in search. This guide shows a safer handoff that takes about a minute and needs no account on the client's side.
Why email and chat are a bad place for passwords
- Messages are kept. Email, Slack and Teams store history for years, including on the client's devices.
- Messages get forwarded. A password in a thread travels with every reply and forward.
- You can't tell who saw it. Once sent, you have no record of whether it was opened, or by whom.
The safer way: a one-time link
- Create the secret. Paste the password into secretbolt.io. Without an account the link opens once and expires in 1 hour. With a free account you can set the number of views, up to 2, and the expiry, up to 24 hours.
- Add a passphrase. Pick a short word or phrase. The link won't open without it.
- Send the link and the passphrase separately. For example the link by email and the passphrase by SMS or phone. Anyone who gets only one of them gets nothing.
- Check that it was opened. With an account, the event log shows when the secret was viewed. After the last view the content is erased.
If someone else opens the link first, your client will see “Secret not found or already viewed”. That is your signal to change the password.
Doing it from a script
If you onboard clients often, create the secret through the API and paste the link from the
response into your welcome email template. jq builds the JSON, so quotes or
$ in the password arrive exactly as typed. Don't type the passphrase into the
command itself: shells save commands in history. read -rs PASSPHRASE asks for it
without showing it and keeps it out of history:
read -rs PASSPHRASE # typed, not echoed, not saved in shell history
curl -fsS -X POST https://secretbolt.io/api/v1/secrets \
-H "Authorization: Bearer $SECRETBOLT_API_KEY" \
-H "Content-Type: application/json" \
-d "$(jq -n --arg content "$CLIENT_PASSWORD" --arg passphrase "$PASSPHRASE" '{
name: "Client login", content: $content, passphrase: $passphrase,
max_views: 1, expires_in_hours: 24}')"
# → {"url": ".../s/…", ...}All parameters are in the API docs.
Good habits
- Ask the client to change the password after the first login.
- One secret per password: don't bundle several logins into one link.
- Never send the passphrase in the same message as the link.