How to share passwords, secrets, and authenticator codes securely

Everyone has done it: a password dropped into a chat, an API key pasted into an email, or a call spent reading out a six-digit code. It works, but that secret now sits in a message history indefinitely, and anyone who gets into that account can read it.

There are better ways, and the right one depends on who you are sharing with and for how long. Here is how to do each one with VaultKeep.

Pick the right method

• One person, one time: use a share link.
• A family or team, ongoing: use an organization vault.
• Only some of the team: use a secret folder.
• Codes that arrive by email: use a shared inbox.

How to share a password or secret with a link

Share links are best for one-off handovers, and the recipient does not need a VaultKeep account. A shared login includes its username, password, and secrets, so this also works for API keys, license keys, and recovery phrases stored in an item's secrets field.

1. In your vault on the VaultKeep website, find the login and click Share.
2. Choose an auth code. The recipient must enter this to open the link, so make it hard to guess.
3. Choose your limits: one-time use, an expiry date, or a viewing window that closes a set number of minutes after the first view.
4. Create the link and copy it.
5. Send the link and the auth code through different channels, such as the link by email and the code by text message.

The link alone unlocks nothing, because the item is encrypted on your device with a key that needs the auth code. You can see your active links, change the auth code, or revoke a link at any time.

How to share an authenticator code

Sharing two-factor is awkward when the code lives on one phone and expires every 30 seconds. An authenticator share link gives the other person live codes without you having to be there.

1. Open the Authenticator tab in your vault, find the entry, and choose Share.
2. Set an auth code and your limits, just as you would for a password.
3. Send the link and the auth code separately.
4. The recipient enters the auth code and sees the live code, ready to copy.

Know what you are handing over. The recipient can also import the secret into their own authenticator app from that page. That means revoking the link stops the link, but it cannot stop an authenticator they have already set up. When someone should no longer have access, reset two-factor on that account. Only share an authenticator with someone you would trust with the account, and use a one-time link or short viewing window if you can.

How to share passwords and 2FA codes with your team

If you keep sending the same people the same logins, stop using links and create an organization. Everyone gets the shared logins and authenticator codes in VaultKeep, and they autofill like personal items.

1. Open Organizations in the VaultKeep web app and create a Family or Business organization.
2. Invite members and give each one an admin or member role.
3. Add new items to the organization vault, or move existing items there from your own vault.

This is ideal for a company social account: the login and its two-factor code live in one place, and nobody has to ask for a code from whichever phone it was set up on.

How to limit access with secret folders

Not everyone needs everything. In your organization's admin page, create a secret folder, such as production credentials or one client's accounts, and assign only the members who need it. Owners and admins can always see every folder.

Each folder has its own encryption key, sealed individually to its assigned members. When you remove someone, the key is rotated and the folder is re-encrypted, so the access they had is actually revoked and not just hidden from view.

How to share email sign-in codes

Some services only send sign-in codes or magic links by email, which leaves your team waiting on whoever owns that mailbox. A shared inbox fixes this without giving anyone your email password.

1. Open Inboxes in VaultKeep and create a new inbox.
2. Add the allowed senders, as a whole domain or a single address, and choose how long to keep emails.
3. Set up forwarding in your mailbox for those senders only, using the filter VaultKeep gives you.
4. Invite the people who need to read those emails.

Emails from anyone else are dropped, each message is encrypted on arrival, and messages delete themselves after the time you chose.

Rules for sharing any secret

• Never send a secret and the code that unlocks it through the same channel.
• Share as little as possible, for as short a time as possible.
• Remember that a person who has seen a password can keep it. Sharing tools control access, not memory.
• Change passwords and reset two-factor when someone leaves or a job ends.
• Never share your master password or recovery kit, with anyone.

Ready to stop pasting passwords into chat? Create a free VaultKeep account, or read how to back up Google Authenticator if your codes are still stuck on one phone.

Frequently asked questions