The Password is Already Broken

A couple years ago, a manager for a highly regarded Sydney restaurant needed help with their website. They explained the problem, and sent over the login details so we could take a look. What arrived in my inbox was not a temporary account and password; they were the root credentials. Full access to everything. And we weren’t the first people they called for help. These were now in at least five other developers hands.

This is how access moves between separate teams every day. Securely sharing a login requires both people to be in a shared system. When they’re not, email becomes that shared system, but it’s not designed for sharing sensitive access credentials. It’s not so much carelessness, but just the only obvious option to many and that’s why it never gets fixed.

The cup is already broken

There’s a Thai Buddhist teaching, where the monk holds up a glass and says he already understands it as broken. It is useful now, but it is living on borrowed time, so the day it shatters carries no shock.

The password you just emailed is the same.

Your mailbox is secure right up until it is not. The breach that exposes it may not have happened yet. A browser plugin you install next year that reads more than it should. An AI assistant you grant mailbox access to without checking the scope. A provider breach that surfaces five years from now. Whenever it lands, every password you ever sent in plain text is sitting, waiting.

So stop defending the cup. Assume it is gone, and fix the thing that actually matters: secrets should not be sitting in places that keep a record.

The fix: give people their own way in

Almost all of this comes down to one move. Stop sharing secrets. Share access instead.

Invite, do not send. Most systems let you add a person directly. They get their own login, tied to their own identity, and nothing sensitive ever crosses the wire. In most cases this replaces the emailed password outright.

One account per person. Shared logins feel efficient now but cost you later. You can’t see who did what, you can’t remove one person without rotating the password the rest of the team still needs. Separate accounts mean you switch one off and nobody else notices.

For the genuinely shared stuff, use a password manager with a sharing feature. A password manager stores credentials in an encrypted app, separate from your email and messages. Most have a team or shared vault option where you invite someone to an entry rather than sending them the password itself. They get the credential through the app, without it ever travelling through email, and when the project ends you revoke it in one place. Nothing sits in a mailbox. If it’s a small team and everyone involved is on Apple devices, the built-in Passwords app covers this at no extra cost. Otherwise most of the major password managers offer a team tier.

Turn on MFA everywhere. This is the backstop for the times a password slips through anyway. Even leaked, it is not enough on its own. Avoid SMS codes where you can, they are the weakest version. An authenticator app is better. Better again is to drop the separate second step altogether, which is where passkeys come in.

Passkeys: nothing to send, nothing to steal

A passkey removes the shared secret entirely, so there is nothing left to email.

The mechanism in one breath: your device makes a pair of keys. One stays locked on the device and never leaves it. The other goes to the service. To log in, the service asks your device to prove it holds the private half, and it does that after you confirm with Face ID, a fingerprint, or your device PIN. Nothing sensitive travels, so nothing can be intercepted, phished, or pasted into a message.

That one step is already multi-factor. It confirms something you have, the device holding the key, and something you are or know, the face, fingerprint, or PIN that unlocks it. So a passkey does not sit on top of a password as an extra factor. It replaces the password and carries both factors itself.

What this looks like in practice

A new contractor joins. Instead of you sending a login, you invite them to the system. They accept the invite on their own laptop, sign in to their own account, and set up a passkey. Ten seconds. After that, getting in is a glance or a touch of the sensor. With no password to hand over, there is nothing in your sent folder, nothing in their inbox, and nothing for a future breach to find. When the project ends you remove their account, and there is no shared credential left to rotate, because there never was one.

Not every system supports passkeys yet, so this is not a switch you flip everywhere this afternoon. It is the default to reach for on anything new, and the direction to move the rest in.

When you genuinely cannot avoid it

Sometimes the system has only a shared login, there is no password manager, and the work has to happen now. Fine. Do it with the least damage.

First, do not put the credential in the email at all. Use a tool that generates a one-time link instead. You paste the password, it gives you a URL, you send the URL. The moment the recipient opens it the secret is gone from the server. Nothing sits in a mailbox, and if the link does not work when they open it you know immediately that someone else got there first.

Treat the password as burned the moment you send it regardless. Make it temporary if you can, and rotate it the moment the person has used it to set up their own access. The credential should be dead within the hour.

It is not about distrust

None of this says anything about the people involved. The risk is not that someone is careless or dishonest. It’s that plain-text secrets in mailboxes are a quiet liability neither side can see until the day it matters. Doing this well is both sides agreeing not to leave landmines in each other’s systems.

The anxious version of security clutches the cup and hopes. The calm version knows it is already broken, so it stops storing secrets where they linger, gives everyone their own way in, and moves towards having no password to send at all.