Send a password that destroys itself once it has been read.
Everybody pastes credentials into Teams and email, where they sit in a thread for years. GhostPush is the tool we built so our own clients would stop doing it. It is free to use and anyone can.
The browser generates a random key and encrypts the secret with it. Only the locked result is ever sent to the server. The plaintext does not cross the wire.
It sits in the part of the URL after the #, which browsers are not permitted to send to a server. It reaches the recipient without ever reaching us.
Once the last view is spent the record is deleted. If nobody opens it, it expires on its own. Either way it does not sit in a mail thread forever.
We kept telling clients to stop emailing passwords without handing them anything better, so we built the better thing. It is also the plainest answer we have to the question of whether the people advising you can actually build. This is what that looks like when it is running in production.