Credentials
How to Ask Clients for Passwords Securely
The safest way to get access is often not to collect a password at all. Ask clients to grant delegated access where they can, and when a secret has to be shared, use an encrypted expiring link or a password manager, never email or chat.
Before you ask for a password at all, check whether the client can simply grant you access instead. Most platforms let someone add you as a user or a partner, so no secret ever changes hands and you can be removed cleanly at the end. When a credential genuinely has to be shared, don't put it in email, chat, or a spreadsheet. Use a password manager's sharing or an encrypted link that expires, and rotate access when the engagement ends.
Why "just email me the login" goes wrong
Emailing a password feels quick, and that's the problem. The credential lands in the client's sent folder, your inbox, and both providers' backups, with no expiry and no record of who opened it. Email travels between servers you don't control, and one autocomplete slip sends a client's login to a stranger. Chat tools are no better. In Slack or WhatsApp you can't see who read or forwarded a message, and you can't withdraw access from one person without changing the password for everyone.
None of this is exotic. It's the ordinary way credentials leak, and it's avoidable.
The options, compared
| Method | Password shared? | Exposure afterward | Best for |
|---|---|---|---|
| Grant delegated access | No | You're a removable user | Any platform with add-a-user or partner access |
| Password manager sharing | Yes, in a vault | Time-limited, revocable | Credentials the team reuses |
| Encrypted expiring link | Yes, once | Expires, not in any message | A one-off secret to hand over |
| Email / chat / spreadsheet | Yes, in plain sight | Lives on indefinitely | Nothing |
How to ask, step by step
- Try access instead of a password. Ask the client to add you as a user or grant partner access. If that covers it, you're done.
- If a single secret must move, send it through a password manager or a one-time encrypted link, and share any passcode on a separate channel.
- If you need a whole set of credentials (API keys, database or hosting logins with no delegation path), collect them through one encrypted request rather than a string of messages.
- Set limits: an expiry, restricted access, and a record of what was shared.
- Rotate or revoke when the work ends, so old access doesn't linger.
- Say it in the contract. Tell clients up front how credentials will be exchanged, and they'll expect the secure method from day one.
Where doconvoy fits
When access can't be delegated and you need to collect a set of secrets, that's where doconvoy helps. The client opens one encrypted request and enters each credential, encrypted in their browser before it leaves their device, with no account to create. You get expiry, access controls, and a timestamped record, so nothing lands in an inbox. For a single throwaway secret a password manager or one-time link is enough. doconvoy is for the structured collection, not every case.
Send clients one encrypted request for the logins and keys a project needs.
Collect credentials securelyRelated: Receive client credentials · Collect client API keys · Secure Requests · Is it safe to send passwords over email or Slack?
Common questions
Is it safe to send a password by email?
No. Email isn't encrypted end to end, the message sits in both sent folders and their backups with no expiry, and a single mistyped address sends the credential to the wrong person. If a password was already emailed, treat it as exposed and rotate it.
What's the most secure way to get access to a client's account?
Usually not a password at all. Most platforms let a client add you as a user or grant partner access (WordPress, Google, Meta Business Manager), so no secret changes hands and access can be revoked cleanly when the work ends.
Password manager or a secure link?
Use a password manager's sharing for a credential your team will reuse. Use an encrypted, expiring link for a one-off secret you just need to hand over once. Either keeps the password out of email and chat.