Why emailing passwords is almost always a bad idea
The habit everyone has — and shouldn't
Ask any IT professional about their biggest security pet peeve and "passwords in email" will come up within seconds. Yet the practice persists. It's easy to understand why: email is the universal communication tool, everyone has it, and typing a password into a message takes five seconds. The problem is that those five seconds of convenience can cause months of headaches.
What actually happens when you email a password
When you send a password over email, you don't just send it once. You send it to:
- Your own outbox — stored indefinitely on your mail server
- The recipient's inbox — where it sits alongside hundreds of other messages
- Any mail servers in between — potentially multiple hops that each log traffic
- Backups and archives — email is routinely backed up, sometimes for years
Most email traffic, especially between different providers, is transmitted without end-to-end encryption. Even when TLS is used in transit, the message rests unencrypted on the receiving server. Anyone with access to that server — or anyone who compromises the account — can read every password ever sent there.
Forwarding and reply chains multiply the risk
Email threads have a life of their own. A colleague replies with "thanks" and the original message with the password is included in the reply chain. That chain gets forwarded to a third party for context. Suddenly a password shared with one person has been seen by four. None of this is malicious — it's just how email works.
GDPR and regulatory exposure
If the systems those passwords protect contain personal data — customer records, HR files, financial data — sending the credentials unencrypted by email is likely a GDPR violation. Data protection authorities have fined organisations for exactly this kind of careless credential handling. The principle is straightforward: if you must protect the data, you must protect the keys to that data.
The simple alternative
The fix is not complicated. A one-time secure link does what email cannot:
- The password is encrypted at rest
- The link expires automatically after a set time or after a single view
- Once retrieved, nothing remains on the server
- There is no chain of copies building up across inboxes
PassTransfer lets you generate a one-time encrypted link in seconds. You share the link via email, chat, or any channel you like — and even if someone intercepts it, the link can only be opened once. After that, it's gone.
The rule of thumb
Treat a password the way you'd treat a physical key. You wouldn't photocopy a key and post the copies around the office. Apply the same logic to credentials: share them through a channel designed for one-time delivery, then let the secret disappear.
Email is a great tool. It's just not the right tool for passwords.
