The safest way to share a password with a client is a single-entry, encrypted link that expires, not an email, a chat message or a shared spreadsheet. Secure It Password Manager shares one entry through an encrypted copy in your Google Drive and a link that expires (15 minutes to 7 days), with an optional passphrase.
An expiring share link gives one recipient access to one entry for a limited time. That is the whole idea, and everything below is about getting as close to it as you can.
Why email and chat are the wrong place for a login
A password sent in a message stays there. Email sits in at least two mailboxes plus backups, and chat tools often keep history for as long as the workspace exists. Slack, for example, says that on paid plans data is kept for the lifetime of your workspace by default (Slack Help Center). Anyone who later gets into either mailbox, or a synced laptop, finds the login in a search.
The standards agree on the direction. OWASP's Secrets Management Cheat Sheet says: "Never transmit secrets via plaintext" and recommends rotating secrets so that stolen ones only work for a short time (OWASP). NIST SP 800-63B requires an authenticated protected channel with approved encryption when passwords are exchanged, and it says email must not be used for out-of-band authentication (NIST SP 800-63B). NIST's text is about authentication systems rather than client handovers, but the principle carries over: a secret should not travel through a channel you can't control.
Stolen logins are also a common way into accounts. Verizon's 2025 Data Breach Investigations Report put credential abuse first among initial access vectors, at 22% of breaches (figure as reported by Aembit's summary). The 2026 edition counts differently, with pretexting added as its own vector, and puts vulnerability exploitation first (Verizon DBIR). Either way, a login left in a mailbox is an easy thing for an attacker to find.
What a good sharing method needs
Use this checklist for any method, including ours:
- Encrypted in storage and in transit, so the message itself is not readable by whoever holds it.
- One entry only. The client or VA gets one login, not your vault.
- Expires. Access ends on its own after minutes or days, not whenever someone remembers.
- Optional second factor. A passphrase, sent through a different channel from the link, means a leaked link alone is not enough.
- Rotate afterwards. For a long-term account, change the password when the job ends, as OWASP advises.
How the options compare
Table last updated October 2026.
| Method | Encrypted | Expires | Where the data lives |
|---|---|---|---|
| Email or chat message | Usually only in transit | No | Mailboxes, chat history and backups |
| Shared spreadsheet or doc | Depends on the tool; rarely end-to-end | No, unless you remove access | The document provider's servers |
| Share feature of a cloud password manager | Yes, typically | Varies by product | The vendor's servers |
| Secure It expiring link | Yes, an encrypted copy of one entry | Yes, 15 minutes to 7 days | Your own Google Drive |
The "cloud password manager" row is where the storage question matters. Bitwarden's cloud accounts live in Bitwarden's cloud, in a US or EU region (Bitwarden). 1Password hosts account data in the region you pick at sign-up (1Password). Secure It stores the encrypted data in your own Google Drive instead.
Secure It is a zero-knowledge password manager that stores your encrypted vault in your own Google Drive: no company servers, not even ours. Your vault is encrypted on the device with Argon2id and AES-256-GCM before it goes anywhere, and the shared entry is an encrypted copy, so we never hold a copy of your client's login either.
How to share one entry in Secure It
- Save the client login in your vault. Pick a category such as Work, or make your own.
- Open that entry and use its share option. Only this one entry is shared, not the vault.
- Choose an expiry. Anything from 15 minutes to 7 days. Pick the shortest that works.
- Add a passphrase if the login is sensitive. It is optional.
- Send the link, then send the passphrase another way. For example, the link by email and the passphrase by phone call or text.
We have not added screenshots of each screen here yet, so exact button names in the app may differ slightly from the wording above. The app's own screens are the reference.
Handing a VA temporary access
For a virtual assistant doing a one-off task, share only the entry they need and set the expiry to match the job: 15 minutes for a quick handover, a few days for a short project. Send the passphrase by a different channel. When the task is done, change the password if the account matters. That way you never have to share your own account by giving someone your master password.
Why this suits freelancers and agencies
You probably have far more logins than the average person: client social accounts, ad platforms, hosting, SaaS tools. A password manager keeps them in one place, and the share link replaces "can you send me the login?" threads. Secure It is a one-time purchase of US$4.99 (local prices vary by country on Google Play), with no subscription. The Windows app and Chrome extension are included.
Secure It is also available in 12 languages, which helps when clients are in other countries.
Honest limits
- Single entries only. Secure It shares one entry at a time. It is not a team vault: there are no roles, admin controls or audit logs for a team.
- Android is in closed testing. It can't be bought on Google Play yet. The Windows app is live on the Microsoft Store, and the Chrome extension is on the Chrome Web Store. See the download page for current status. There is no iOS app yet.
- No independent audit yet. We have not had a third-party security audit. See our security page for how the encryption works.
- Google account for sync. Using the vault on several devices needs a Google account, because sync goes through your own Google Drive. One device works offline without one.
- Independent developer. Secure It is built by a small, independent developer, not a large security company.