Where your password actually goes
When you paste a password into WhatsApp, email, or SMS, you are creating permanent copies in more places than you think. Message histories sync across devices, mail providers index inbox content, telecom systems handle SMS in plaintext, and backups keep everything for years.
None of those systems were designed to store credentials. They were designed to keep conversations. The difference matters because a password stays dangerous long after a conversation feels finished.
What to do instead
A better habit takes barely more time than pasting into chat. Encrypt the password in your browser so it becomes unreadable ciphertext, generate a one-time link, and send that link through your normal channel. If the platform supports it, send the decryption password separately so no single message reveals everything.
With burn-after-read delivery, the credential disappears after the first view, so a forwarded message or an old backup contains nothing useful. The channel still carries the message, but the message no longer carries the secret.