How to send sensitive information securely online

Sooner or later you need to send something you'd rather not put in writing. Your bank details for a payment. A copy of your passport for a booking. A private note, a recovery code, a contract clause. Something that shouldn't live in an inbox forever.

Most people send it the easy way — email or chat — and hope for the best. The information arrives, the task gets done, and a permanent copy quietly sits on a handful of servers from that day on.

Why email and chat aren't built for this

Email and messaging apps are designed to keep things, not destroy them. That's exactly what you want for a conversation and exactly what you don't want for sensitive information.

• It persists. Once it's sent, you no longer control it. It's in their inbox, their backups, their cloud sync — for as long as they keep the account.
• It's easy to leak. A forwarded email, a shared screen, a borrowed phone. Sensitive details escape through ordinary, everyday actions.
• It's a target. Inboxes are the single most attacked thing online. If an account is breached, everything ever sent to it is exposed at once.
• You can't take it back. There's no expiry, no recall, no way to make it disappear after the moment has passed.

The principle: share access, not a copy

The secure way to send sensitive information flips the model. Instead of sending the information itself, you send a link to it — and you stay in control of that link.

The information is encrypted and stored behind a one-time link. You decide how long it lives: until it's read once, or until a deadline you set. After that, it's gone. Nothing for an attacker to find later, nothing sitting in a backup, nothing to forward.

What counts as sensitive information

It's worth being generous about what belongs in this category. Common examples:

• Bank account and sort codes for a one-off payment
• Login credentials and recovery codes
• Copies of ID — passport, driving licence, utility bills
• Private contracts, legal notes, or financial figures
• Anything you'd describe out loud rather than write down

If you'd hesitate to read it aloud in a crowded room, it shouldn't be sitting permanently in someone's inbox.

How to do it in practice

1. Put the information into a secure sharing tool. It encrypts the content and gives you a link.
2. Set an expiry. One read, or a time limit — whatever fits. Shorter is safer.
3. Add a passcode for the sensitive stuff. Send the passcode separately from the link.
4. Send the link however you normally would.
5. Confirm it was opened. A read notification tells you the right person got it.

A few habits that help

• Split the link and the passcode across two channels — email and text, for instance.
• Use the shortest expiry that's practical. If they'll read it in the next hour, don't give it a week.
• Don't reuse a link. Generate a fresh one for each thing you send.
• Tell the recipient it's one-time so they don't try to bookmark it and panic when it's gone.

The bottom line

Sending sensitive information online is unavoidable. Leaving a permanent, forwardable, searchable copy of it in someone's inbox is not. Share access instead of a copy, set it to disappear, and the information exists only for as long as it needs to — then it's gone.