How to send temporary passwords safely
Why temporary passwords are everywhere
Temporary passwords appear constantly in day-to-day operations. A new employee needs initial access to a system. A client needs to log in to a portal for the first time. A support technician needs to access an account to diagnose a problem. In each case, someone generates a temporary credential and has to get it to the right person.
The word "temporary" lulls many people into a false sense of security. "It's only valid for a short while, so it doesn't matter how I send it." But even a short-lived password, sent carelessly, can be intercepted or discovered before the recipient has a chance to change it.
The risks specific to temporary passwords
Temporary passwords often have predictable characteristics. Many systems generate them automatically with a simple format — a word and a number, or a short random string. They're designed to be easy to type on first login. That predictability makes them easier to guess if an attacker knows your system's generation pattern.
More importantly, temporary passwords sit in inboxes and chat logs waiting to be used. Unlike a permanent password that a user creates and immediately acts on, a temporary one might sit unread for hours or days. That's a larger window of exposure.
Best practices for sending temporary passwords
1. Use a one-time encrypted link Send the password as a one-time encrypted link via a tool like PassTransfer rather than in the message body itself. The recipient gets a link; when they click it, the password is displayed and immediately deleted from the server. If the message is intercepted before the recipient opens it, the link can only be opened once — so you'll know something is wrong.
2. Set a short expiry Match the expiry time of your link to the urgency of the situation. For a new employee starting tomorrow, a 24-hour expiry is sensible. For a support session happening right now, an hour is plenty. Shorter windows mean less exposure.
3. Communicate through a second channel when possible Tell the recipient verbally or via phone that a link is coming. This way they know to look for it promptly and you confirm it reaches the right person.
4. Require an immediate password change Always configure systems to force a password change on first login. The temporary password becomes worthless the moment the user sets their own. This limits the damage window even if the temporary credential was compromised in transit.
5. Avoid reusing temporary passwords Generate a fresh credential each time. Never use the same temporary password for multiple users or multiple occasions.
The process in practice
A good workflow looks like this: generate the temporary password, paste it into PassTransfer, set an expiry of 24 hours, and send the resulting link to the recipient. Follow up with a quick message: "I've sent you a secure link with your login details — please open it and change your password as soon as possible." Simple, auditable, and significantly more secure than a plaintext email.
Conclusion
Temporary passwords deserve the same care as permanent ones. The channel you use to deliver them matters. A one-time encrypted link is the easiest way to ensure that the credential reaches exactly one person, exactly once, and then disappears. For the broader context, see our complete guide to secure password sharing.
