Share a password securely with Privnote

  • security
  • passwords
  • privnote
  • logins

Updated

Privnote (privnote.com) is a free site that turns a note into a one-time link that destroys itself once it's read. To send a password safely, put it in a Privnote and email or text the link instead of the password, so the password never sits in anyone's inbox or chat history. If someone needs ongoing access to your website, domain, or email, give them their own login instead of sharing yours.

What Privnote is

Privnote is a free website for sending a note that can be read once. You don't need an account. You type a message, Privnote gives you a link, and the first person to open the link sees the message. Privnote then deletes it, so the link shows nothing the second time.

That makes it a good way to hand over something sensitive once: a password, a hosting login, a Wi-Fi password, or a bank detail. It isn't a place to store passwords, and it isn't a way to give someone lasting access.

Make sure you're on the real Privnote

The real site is privnote.com. Lookalike sites with similar names (an extra letter, a different ending such as .co or .org) copy its design to steal what people type into them.

  • Type privnote.com into the address bar yourself, or use a bookmark.
  • Don't use a Privnote link from an ad or a search result you haven't checked.
  • If a link someone sends you points anywhere other than privnote.com, ask them about it before opening it.

Send a password with Privnote

  1. Go to privnote.com.
  2. Type the password into the note. Leave the username out: you'll send it separately.
  3. To change how the note behaves, click Show options (see below). The defaults are fine for most passwords.
  4. Click Create note.
  5. Copy the link Privnote shows you. This is the only time you'll see it.
  6. Send the link to the person by email, text, or a chat app such as WhatsApp. Send the username, and what the password is for, in a different message or another way, such as a phone call.

Don't open the link yourself to check it: that counts as reading the note, and it's destroyed.

Privnote's options

Under Show options you can:

  • Choose when the note self-destructs: straight after it's read (the default), or after a set time even if nobody has opened it. A time limit is useful when you're not sure the person will open it soon.
  • Add a password to the note: the reader has to type it before the note opens. Tell them that password another way, such as a phone call.
  • Get an email when the note is read: add your email address and a reference name, and Privnote lets you know when it's opened and destroyed.

Leave the confirmation step turned on. It warns the reader before the note opens, which stops it being destroyed by an email app or chat preview that opens links automatically.

Open a Privnote someone sent you

  1. Click the link. Check the address bar shows privnote.com.
  2. Confirm that you want to read the note.
  3. Copy the password straight into your password manager, or wherever you need it, before you close the page. You can't open the note again.

If the link says the note has already been read or destroyed, and you didn't open it, someone else may have. Tell the sender, so they change that password and send a new note.

Is Privnote safe?

For handing over a password once, Privnote is much safer than email or text. The password isn't left in either person's messages, and it can only be read once. Keep in mind:

  • Anyone who gets the link before your recipient can read the note. Send the link only to the person who needs it.
  • Fake Privnote sites exist. Use privnote.com.
  • Once the person has the password, it's as safe as wherever they keep it. Ask them to store it in a password manager.

If your business already uses a password manager such as 1Password or Bitwarden, its sharing feature is a good alternative: you can share a login and remove access later.

When to give someone their own login instead

Sharing your own password is fine for a quick, one-off job. For anyone who needs access for longer (a web designer, a developer, or a new staff member), give them their own account. You can see what they did, and you can remove their access without changing your password.

After you've shared a password

  • Change the password once the work is finished, or once the person no longer needs it.
  • Turn on two-factor authentication wherever you can, so a password alone isn't enough to sign in.
  • If you think a password reached the wrong person, change it straight away. If it's for your website, see My WordPress site was hacked. What do I do now?.

Built by Dirigible Studio. Get in touch