Why secrets in Slack or Teams are a bad idea
The collaboration platform trap
Slack and Microsoft Teams have become the default layer of workplace communication. Conversations that used to happen via email or in-person now happen in channels and direct messages. And because they're fast, familiar, and always open, people share things in them that they probably shouldn't — including passwords, API keys, and other credentials.
It's understandable. You're in the middle of a task, you need a colleague to have a credential right now, and the message box is right there. Typing the password into the chat takes five seconds. The problem is that those five seconds create a security liability that can last for years.
Why Slack and Teams are poor places for secrets
Message history is persistent Unlike a phone call or an in-person conversation, a message in Slack or Teams doesn't disappear when the moment passes. Unless someone actively deletes it, that message will be in the channel history indefinitely. A password shared in 2022 might still be searchable in 2026.
Search makes old messages findable This persistence is compounded by the fact that these platforms are highly searchable. An attacker who gains access to your Slack workspace — via a compromised account, a phishing attack, or an insider — can search for "password", "API key", "secret", and find everything in seconds.
Workspace exports Many organisations retain Slack or Teams exports for compliance or backup purposes. These exports contain every message ever sent, including any credentials that were shared. An export sitting on a file server is an additional exposure vector.
Channel membership is rarely audited How often do you review who has access to each channel in your Slack workspace? Former employees, contractors, and people added long ago for a specific project often retain channel access. Any secret shared in that channel is visible to all of them.
Bots and integrations Slack and Teams workspaces are often connected to dozens of third-party integrations. Some of these have access to message history. Every integration with message read access is a potential leak point for anything shared in messages.
The right approach
The fix is simple and adds almost no friction. Instead of typing a credential into a Slack message, create a PassTransfer link and paste the link into Slack. The colleague clicks the link, retrieves the credential, and the link expires. The Slack message now contains a dead URL rather than a live secret. Historical searches find nothing useful. Workspace exports contain nothing sensitive.
You're still using Slack as the communication channel. You're just not using it as a secrets store.
For teams that want to go further
If your organisation wants to move beyond ad-hoc practices, establish a policy: no credentials in collaboration platforms. Instead, credentials should be delivered via a one-time encrypted link (for one-off transfers) or managed in a team password manager (for ongoing shared access). Make the policy easy to follow by providing the tools and brief training.
Conclusion
Slack and Teams are excellent for collaboration and poor for secrets. The combination of persistent history, powerful search, and broad access makes them particularly unsuitable for credential sharing. The solution is not to stop using these platforms — it's to use them for the link, not the secret. For the bigger picture, see our complete guide to secure password sharing.
