How to share a password safely
When you absolutely must share a password with our team, here is the right (and wrong) way to do it.
While we always prefer delegate access (inviting support@chykalophia.com as a user), some older systems or specific domain registrars force you to share a single master password.
If you must share a password with our team, never send it in plain text via email, Slack, or text message. Once a plain-text password is sent via email, it sits in your sent folder and our inbox indefinitely, creating a major security risk.
Plain text
The password sits in your sent folder and our inbox indefinitely.
Slack or a text message
SMS is not encrypted end-to-end, so it isn't a secure way to send business credentials.
A secure link
A self-destructing link
Onetime Secret shows the secret once, then purges it.
A password manager share
1Password or Bitwarden Send, set to expire or stop after one view.
Sent separately
The username in plain text, the password only behind the link.
The right way to share a password
To protect your business, please follow these steps to securely transmit a password to the Chykalophia team.
Use a secure sharing tool. Go to a free service like Onetime Secret or Bitwarden Send. If you already use 1Password, open the item, choose Share, and copy the link it gives you.
Enter the password. Type or paste only the password into the box for the secret. Do not include the username or the website URL in it.
Generate the link. Click the button to create your secret link. Onetime Secret is built for exactly one view: it says that after a single view "the secret is permanently purged from all storage". Bitwarden Send and 1Password let you choose when the link expires, and both can also make the link stop working after one view. Turn that on if you want the same read-once behavior.
Send us the link and login URL. Head over to your support ticket (support portal). Provide the login URL and the username in plain text, and paste the secure link for the password. Never email the password itself.
Example of a secure message to our team:
"Here are the logins for our GoDaddy account. URL: godaddy.com Username: mybusiness@gmail.com Password: [Link to Onetime Secret]"
What happens next?
With a one-time link, the password is revealed to us the first time we open it and then deleted at the other end: Onetime Secret describes it as "no copies, no recovery, no trace". We copy the password straight into our encrypted, internal password manager. Anyone else who opens the link afterwards finds nothing there.
Common questions
I already emailed you a password in plain text. What should I do?
Don't panic, but please log in to that service immediately and change your password to something new and strong. Once changed, use the secure method above to share the new password with us.
Can I just text it to my project lead?
No. SMS text messages are not encrypted end-to-end and are not a secure way to transmit business credentials. Please use a one-time secure link.
Related guides
Was this page helpful?
- Why we ask for access (and why it's safe)
- Delegate access vs. sharing a password
- How to share a password safely
- Access directory (A to Z)
Go deeper on chykalophia.com
Need a hand?
Stuck? We'll help.
Email us with your website address and a screenshot if you can, and we’ll take it from there.
Last updated