Sooner or later a password has to be handed to someone: a colleague, a contractor, a relative, or yourself on another computer. The method most people use — a message in a chat app — is the worst available, and here is why.
Qué falla en un mensaje
It does not disappear. A copy stays with the sender, the recipient, the backups of both phones and the service’s servers. A year later you will have forgotten it held a password; it will still be there.
It outlives the relationship. A departed employee, a former contractor, a lost phone — each keeps a chat history with every password you ever sent.
It is findable by search. Typing “password” into chat search collects them all at once. That is the first thing done with access to someone else’s messenger.
Email is no better: it is stored longer, copied to Sent and pulled into mail client backups.
Métodos que funcionan
Shared access in a password manager. The best option when both parties use one. The password never leaves the encrypted vault, access is revoked with one click, and a change propagates to everyone it was shared with.
A one-time link service. You put the password into a form, get a link, send it — and after the first opening the content is destroyed. Even if the link resurfaces later, it is already empty.
Splitting the channel. A simple trick without services: send the login in a chat and dictate the password by voice or send it through a different channel. Intercepting one channel then gives nothing.
Paper. For household cases like a Wi-Fi password this is fine: a note is not indexed by search and does not leak along with an account. For Wi-Fi a QR code is even better — the guest joins with a tap and the password is never spoken.
Cuando hay que dictarla
Over the phone a random password becomes a trial: “capital S or lowercase?”, “is that a zero or an O?”.
Two solutions. First, a passphrase: six words are dictated without a single clarification. Second, the speaker button next to the generator output: it reads the password using the phonetic alphabet, stating the case.
If dictation is unavoidable, take a password without special characters and without look-alikes — both are built into the generator filters.
Reglas que conviene adoptar
An issued password is temporary. Whoever created it knows it too. Require a change at first login.
A personal password is never shared. If a colleague needs access, they get their own account. Otherwise nobody can tell who did what.
Shared access has an end date. Agree in advance when it is revoked — and revoke it. That is the step everyone forgets.