How to Share Passwords Securely with a One-Time Link

Need to pass a password to someone? First check whether they can have their own account. This avoids shared account access when the system can give each person their own sign-in. If a one-time handoff is allowed, create a link, send it to the person, and send the unlock key in a separate message. The link can be opened once and expires after five minutes.

For passwords your team uses again and again, use your organisation's approved password manager. A one-time link does not check who opens it, and a recipient can still copy the password. Check the recipient and ask the system owner before sharing.

1. First ask if a shared password is needed

Start with what the person needs to do. Could an administrator give them their own account or access just for that task? That makes it easier to see who did what and remove one person's access later. For Microsoft 365 access reviews, check what the account can actually open, not only the person's job title or an old approval.

If the system offers sign-in with each person's own account, use that instead of passing around one password. Do not share a main administrator password for routine work. When several people use the same password, it is harder to tell who made a change or remove access for only one person.

2. Use a password manager your team approves

For regular access, a password manager for teams can keep the password in one approved place and let you choose who can use it. Check that you are sharing with the right people and that you can remove their access later. A product feature is not automatically approved just because it is available.

If you do not know which tool is approved, ask the system owner first. For secure credential delivery, do not put a password in an email, chat, support ticket, note, or screenshot.

Some teams allow a one-time link for short handoffs. Before using one, check that your organisation permits it and understand how long the link works, whether it can be cancelled, and who can open it. A one-time link is not a second sign-in check. A recipient can copy or photograph the password after opening it.

3. Check who will receive it

Make sure you have the right person. Check their address in a trusted directory or confirm it another way. Ask whether they still need the password and whether its owner approved sharing. If a request feels unusual or urgent, check with the person through a second contact method.

If your rules allow a one-time link, send the link in one message and the unlock key in another. Do not send both together, shorten the link with a public service, or post it in a group chat. If you cannot confirm the recipient, do not send it.

4. Decide when access should end

Write down who owns the password, why it was shared, and when access should end using your team's approved process. Set a reminder to remove access. After the task, remove the person's access or change the password if your rules require it. Before changing a password, check whether a service or scheduled job also uses it so you do not cause an outage.

If you suspect exposure, follow your incident process, revoke access as appropriate, and do not forward the exposed value.

Five quick checks before sharing a password

• Can the person use their own account instead?
• Did the password owner approve the handoff?
• Is this sharing method allowed by your organisation?
• Did you check that the message is going to the right person?
• Do you know when access will end or the password will change?

These checks lower avoidable handling risk; they do not prove a device, mailbox, password manager, or recipient is uncompromised. Revisit the process when the system, team, or policy changes.

What the Cloudek tool can do today

The Cloudek Secure Password page can make a new password in your browser. The value stays on your device unless you choose to create a share. Copying it puts it on your device clipboard, where other apps may be able to read it. Save the password in your approved password manager. Clearing the page or clipboard cannot promise that every copy is erased.

If you choose to share, the browser encrypts the text before sending it to the service. The page offers a link that expires after five minutes, one reveal, an unlock key you can send separately, and a way to cancel a link that has not been opened. Making a share sends encrypted text; generating a password by itself does not.

The public tool does not check who opens a link or stop someone from copying the password after they see it. A cancelled or expired link does not change the password on the account. Try the controls with harmless sample text first. Do not use this public tool for recovery codes, administrator passwords, private keys, payment details, files, or sensitive records. Follow your organisation's rules; use an approved password manager for passwords your team needs to keep using.

For a wider Microsoft 365 security and service-baseline discussion, prepare a non-sensitive service enquiry. A request is not a booking or service guarantee; scope, availability, responsibilities, fees, and timing are agreed separately. Leave passwords and customer evidence out of the enquiry form.