Password advice has changed more in the last few years than in the decade before it. Composition rules and forced 90-day changes are out; length, uniqueness, breach checks and password managers are in. Sharing is where even good passwords get exposed, so this guide starts with what current guidance says and then turns it into a routine for handing a password to someone else.
What current guidance says
NIST SP 800-63B-4, the US digital identity guidelines finalised in 2025, sets the baseline many organisations follow (NIST):
- Passwords used on their own must be at least 15 characters. Eight is the minimum only when the password is one factor in multi-factor authentication.
- Services should allow passwords of at least 64 characters.
- Services shall not impose composition rules, such as requiring a mix of character types.
- Services shall not require periodic password changes, but shall force a change when there's evidence a password has been compromised.
- New passwords are checked against a blocklist of commonly used, expected or compromised passwords.
- Services must allow password managers and autofill, and should allow pasting.
CISA, the US Cybersecurity and Infrastructure Security Agency, recommends passwords of at least 16 characters that are random (a mix of character types, or a passphrase of 5 to 7 unrelated words) and unique to each account, with a password manager to keep track of them (CISA).
The OWASP Secrets Management Cheat Sheet, written for teams, adds two points that matter for sharing: avoid a single shared password for all administrators, and ideally don't send a password together with its username (OWASP).
Rule 1: share access, not passwords, when you can
Every shared password is a credential several people can use and nobody can revoke individually. Before sharing one, check whether the service offers:
- separate accounts or seats for each person;
- single sign-on for your organisation;
- delegated access, family plans or guest access.
If it does, use that. When someone leaves, you remove their access instead of changing a password everyone depends on.
Rule 2: send it through a channel that forgets
If you do have to share, don't paste the password into chat, email or SMS, where it stays in histories and backups. Send a link to an encrypted note that's deleted when it's opened. Is it safe to send passwords over WhatsApp, email, or SMS? explains what each channel actually protects.
Rule 3: separate the pieces for anything important
In the spirit of OWASP's advice not to send a username with its password, split what you send. Put the password in a one-time note, and send the username, or an extra password for the note, through a different channel such as a phone call. Someone who gets into one of your accounts then doesn't get everything.
Rule 4: make it temporary twice
- Make the link temporary: burn after reading, and the shortest expiry that works.
- Make the password temporary where the service allows it: send an initial password that must be changed at first sign-in, so the recipient ends up with a password only they know.
Rule 5: confirm, then clean up
Ask the recipient to confirm they received it, and to store it in their password manager rather than a notes app. Check that the link shows as opened. Delete any drafts, screenshots or copies you made along the way.
Rule 6: change passwords on triggers, not on a timer
NIST no longer asks for periodic changes, but it does require a change when there's evidence of compromise. For shared passwords, the practical triggers are:
- someone who knew it leaves the team, the household or the project;
- the link was opened by someone other than the intended recipient;
- the password was ever sent in plain text, posted in a group chat or committed to a repository;
- the password turns up in a breach. Have I Been Pwned's Pwned Passwords lets tools check this with k-anonymity: the password is hashed locally and only the first five characters of the hash are sent. You can run a check with the breached password checker.
The routine, step by step
- Generate a strong password with a password generator: 16 characters or more, or a passphrase of several random words. To test one you already have, use the password strength checker.
- Store it in your password manager first, so the shared copy is never the only copy.
- Create a one-time note in Secure Notes with burn after reading on and a short expiry. For important accounts, choose Link + password and send the extra password through another channel.
- Send the link in your usual app, with a short line about what it's for.
- Confirm receipt, and check My links to see that it was opened.
- Rotate when a trigger happens, not before.
If you're on the receiving end
Good sharing takes two people. When someone sends you a password:
- Open the link when you're ready to save the password, because a one-time note may not open twice.
- Save it in your password manager straight away, not in a notes app, a screenshot or a reply to the sender.
- If the account is now yours alone, change the password, so nobody else knows the current one.
- If the link was already used when you opened it, tell the sender. Someone else saw it first, and the password needs changing.
- Don't forward the link. If someone else needs access, ask the owner to share it with them directly.
A short team policy you can adapt
Teams follow rules they can remember. Something this short is enough to start with:
Passwords and keys are never pasted into chat, email, tickets or shared documents. To share one, send a one-time link that expires within a day, and give any extra password through a different channel. Anything needed for longer than a week goes in the password manager. When someone leaves, every shared password they knew is changed.
Situations and what to do
| Situation | Best practice |
|---|---|
| A family member needs a streaming login | The service's profiles or family plan if it has them, otherwise a one-time note |
| A new employee's first password | A temporary password that must be changed at first sign-in, sent as a one-time note |
| A contractor needs a tool for a month | Their own account; if that's impossible, a one-time note and a password change at the end |
| A team shares one social media login | A shared vault in a password manager, with multi-factor authentication on the account |
| Guests need the Wi-Fi | A guest network and a QR code; see how to share a WiFi password safely |
| You need a password from someone | A secret request |
Common mistakes
- Reusing a password because it's easy to share. One leak then exposes every account that uses it.
- Sharing a password manager's master password. Use the manager's own sharing features instead.
- Keeping a "passwords" document in a shared drive. It's a vault without any of a vault's protections.
- Reading out multi-factor codes. One-time codes exist to prove it's you. Treat anyone who asks you for one with suspicion.
Where passkeys fit
Passkeys sidestep sharing for the accounts that support them. The FIDO Alliance describes them as a password replacement that is phishing-resistant and designed so that there are no shared secrets. For every account still on passwords, the rules above apply.
When ProtectedShare isn't the right tool
- Ongoing shared access belongs in a password manager's shared vault, where a changed password updates for everyone.
- Organisations with compliance requirements may need sharing that's logged and tied to identities. ProtectedShare records that a link was opened, not who opened it.
- Your own recovery codes belong in your password manager, not in a link that deletes itself.
Sources
- NIST, SP 800-63B-4: Authentication and Authenticator Management
- CISA, Require Strong Passwords
- OWASP, Secrets Management Cheat Sheet
- Have I Been Pwned, Pwned Passwords
- FIDO Alliance, Passkeys