How to send a password to a contractor without email

Send the password as a one-time link. Send the username some other way. Make the account demand a new password at first sign-in. That's the whole answer, and I'm going to spend the rest of this page asking you to do all three, because people do one of them and then we end up here.

The same steps work for a new starter. The difference with a contractor comes after the handover, and it gets its own section below the steps.

The engineer who kept their password in Outlook

This story is made up. Each piece of it has happened somewhere, just never all to one person.

A network engineer starts at a new company on a Monday. The admin generates a password along the lines of k8#F9!mL2$, pastes it into an email with the subject "Your new network password", and asks for it to be changed at first sign-in. Nothing on the account forces the change, so it never happens.

The engineer has better things to memorise. Every morning the routine is the same: open Outlook, type "Your new network password" into the search bar, copy the string and paste it into the sign-in box. This goes on for four years. The email survives two mailbox migrations, because a migration carries old mail across.

Nobody knows until a support call. The engineer shares a screen, gets asked to sign in again, and searches the inbox for the password while the IT team watches. To be fair, the search is very quick.

An emailed password lasts as long as the mailbox

A password sent by email sits in the sender's Sent folder and the recipient's inbox. Anyone who gets into either mailbox can search for "password" exactly the way the engineer did.

The admin console doesn't clean this up for you. When you reset a user in Microsoft Entra ID, Microsoft's own documentation says the temporary password "never expires"^[1]. It adds that the next time the user signs in, "the password still works, regardless of how much time has passed"^[2]. A temporary password nobody got round to using is still a working password, sitting in two mailboxes.

Step 1: make the contractor's account demand a new password

Do this first. It limits the damage when everything after it goes wrong.

In the Google Workspace Admin console, when you set or reset the password, tick the box Google calls "Ask the user to change their password". The user then changes it at their next sign-in^[3].

In Microsoft Entra ID, a password reset by an admin is temporary, and Microsoft says "The user must change the password during the next sign-in process"^[4].

Entra also has a Temporary Access Pass, which Microsoft describes as "a time-limited passcode that can be configured for single use or multiple sign-ins"^[5]. The default lifetime is 1 hour, and an admin can set it anywhere from 10 minutes to 30 days^[6]. A single-use pass that dies in an hour is a much smaller problem to leave lying around.

Yes, the contractor will grumble about choosing a password before they've done any work. I would rather hear the grumbling than watch someone read my password out of Outlook for four years.

Step 2: put the password in a link that burns

On tamingshare.com:

1. Paste the password into "Your secret content".
2. Set "Expires in" to the shortest time that still works for the contractor. The options run from 5 minutes to 1 year^[7].
3. Switch on "Burn after reading". It's optional^[8], and I know. I know.
4. Click "Create secure link" and copy the link.
5. Keep the receipt link for yourself. It never goes to the contractor.

The server never sees the password. Your browser encrypts the password with AES-GCM using a 256-bit key before anything is sent^[9]. The key goes into the link after the # sign. Browsers do not send that part of a URL to the server^[10][11], so the server only ever holds the scrambled version. The email is another matter: until the link is opened, anyone who reads that email can open it too. Steps 3 and 4 are there for that.

With burn on, the contractor first lands on a warning page. Clicking "View secure paste" deletes the note from the server^[12]. From then on the email holds a dead link, and a dead link is a lovely thing to find in a mailbox four years later.

Step 3: send the username somewhere else

The link goes by email. The username goes by WhatsApp, a text or a phone call. Anyone who gets into one of those channels then holds half a login, which is far less useful than a whole one.

Yes, it's two messages instead of one. You'll survive.

Step 4: check the receipt

The receipt shows whether the note is still on the server and when it expires^[13]. Once the note is gone it can't tell you whether it was read, burned or expired, because the server keeps nothing about why^[14].

The receipt still tells you when to reset. Say it shows gone before the expiry time, you didn't burn it yourself, and the contractor says the link was dead when they clicked it. Then somebody else had the link and opened or destroyed it^[15]. Reset the password first and investigate afterwards.

A long-term contractor needs their own account

For a new starter, the one-time link plus a forced change at first sign-in finishes the job. After that the password is theirs and you never knew it.

A contractor is where people get creative. If the contractor needs access for months, give them their own account and disable it when the contract ends. The one-time link covers the first handover of that account's password and nothing more.

If the contractor needs a shared login you can't split per person, that login belongs in a password manager with sharing. Change the password when the contract ends. Please don't email it to them "just this once". It is never just once.

What a one-time link does not protect against

The link protects the trip. What the contractor does with the password afterwards is out of its hands.

• If the contractor pastes the password into a notes app, it lives in that notes app. Step 1 exists for this reason.
• Whoever opens the link first gets the password. Sending the username separately means a mis-sent link gives away half a login, and the receipt shows it was opened.
• With burn switched off, anyone holding the link can open it until it expires.
• A mail link scanner that only fetches the link lands on the warning page and does not burn the note, because burning needs the button click^[16]. I don't know what every scanner does, and one that renders the page and clicks buttons is a different animal. If the receipt says gone and the contractor never saw the password, go back to Step 4.

When not to bother

If the contractor is sitting next to you, let them type their own password on their own machine. No link, no email, no receipt.

If you're on Entra and a Temporary Access Pass fits, hand over that instead of a password^[17]. The link is still how you send the pass.

Now go and search your Sent folder for "password". I'll wait.