You can't put a password on a text message itself. SMS, iMessage and Google Messages have no per-message lock. To password protect a text, put the content in a passcode-protected, self-destructing link, text the link, and share the passcode by phone call or another app. The recipient needs both to read it, once.
Key takeaways
- SMS, iMessage and Google Messages have no way to put a passcode on a single text.
- Phone settings like Face ID app lock and hidden previews protect your copy, not the recipient's.
- The workaround is to text a one-time link that requires a passcode, then share the passcode another way.
- Pick one view plus a short time limit, so the secret doesn't sit in either phone's history.
- Never send the passcode in the same thread as the link.
Can you put a password on messages?
Not on an individual text. SMS, iMessage, Google Messages and Samsung Messages all deliver the full message to the other phone. There's no field where you set a passcode the recipient must enter before the words appear.
What phones do offer is a lock on the whole device or the whole Messages app. That protects your copy of the conversation from someone who picks up your phone.
It does nothing about the copy on the recipient's phone, their lock screen, their cloud backup or the tablet that syncs their messages.
So when people search how to set passcode on text messages, they usually want one of two things:
- Keep my messages private on my own phone. Phone settings can do this.
- Make sure only the right person can read one specific text. Phone settings can't do this. You need to move the sensitive part out of the text and into something that has a passcode.
What iPhone and Android settings can and can't do
These are worth turning on anyway. Just be clear about what each one covers.
iPhone (iMessage and SMS)
- Lock the Messages app. On iOS 18 and later, you can long-press the Messages icon and choose Require Face ID. Anyone opening the app then needs your face or passcode, even if the phone is already unlocked.
- Hide lock-screen previews. Settings > Notifications > Show Previews > When Unlocked stops message text from showing on your lock screen.
- Auto-delete old messages. Settings > Messages > Keep Messages lets you choose 30 days instead of Forever.
- Undo send. iMessage lets you unsend for a couple of minutes, but only between up-to-date Apple devices, and the other person may already have read it.
Android (Google Messages, Samsung Messages)
- Lock the app. Depending on your phone and Android version, you may be able to put a messaging app behind a separate PIN or fingerprint using Samsung's Secure Folder, Private Space on newer Android versions, or your manufacturer's app lock.
- Hide sensitive notification content. Notification settings let you keep message text off the lock screen.
- No per-message passcode. Google Messages doesn't offer one. Third-party apps that promise to lock texts generally just lock the app on your own phone.
The gap all of these share
Every one of these settings protects the sender's phone. Once a text lands, it lives on the recipient's device under their settings: previews on, no app lock, backed up to the cloud, readable by whoever borrows the phone.
You can't put a password on their side of the conversation. You can only avoid putting the secret there in the first place.
How to put a password on a text message, step by step
The workaround is to text a link instead of the secret. The link opens a note that asks for a passcode, shows the content, then destroys itself. The text thread only ever holds a link that stops working.
Here's how to do it with SecureNotes, which is free and needs no account:
- Paste only the sensitive part. Create a self-destructing note and paste just the secret, such as a door code or an account PIN. Keep the context (here's the code for Saturday) in your normal text.
- Choose when it self-destructs. For most texts, pick 1 view. Add a time limit such as 24 hours so an unopened link doesn't hang around. The note is destroyed at whichever comes first.
- Add a passcode. Pick something short enough to type on a phone keyboard, but not guessable from the thread, like the recipient's name or your street.
- Optionally turn on a read notification. SecureNotes can email you when the note is read, so you know it reached the person.
- Text the link. Paste it into iMessage, SMS or any chat app. Tell the person to expect it, so it doesn't look like a phishing link.
- Send the passcode another way. Say it on a phone call, or send it in a different app from the link. Never in the same thread.
Each note is encrypted with AES-256 using its own random key before it's stored. Once it's read or expires, the link stops working.
The passcode is the step people skip. In SecureNotes data, only 18% of notes are protected with a passcode, while 69% are set to self-destruct after a single view. One view stops anyone reading the link later. The passcode is what stops someone who sees the link first, such as a person glancing at an unlocked phone.
If you're unsure what to use as the passcode or how to deliver it, see how to send a note's passcode safely.
Worked example: texting alarm codes to a pet sitter
Dana flies out Friday morning. Her neighbor Sam is feeding the cat for the weekend and needs the garage keypad code and the alarm disarm code.
Dana doesn't want those codes sitting in Sam's messages forever, right above a photo of her front door. Here's what she sets:
- Note content: Garage: 4471. Alarm: 9032, then press Off.
- Destroy after: 1 view or 24 hours, whichever comes first. Sam plans to open it Thursday night. If he forgets, the codes don't linger for a week.
- Passcode: tabby, a word she told Sam during a quick call on Wednesday.
- Read notification: on, so she knows Sam has the codes before she boards.
Her text says: Here are the codes for the weekend. The link only opens once, so write them down. Passcode is the word I told you on the phone.
Sam taps the link, gets asked for the passcode, types tabby and reads the two codes. He writes them on a card he'll bring to her house. Dana gets an email saying the note was read.
If anyone opens the link after that, it no longer works. When Dana gets home Monday, she changes the alarm code, because a code that's been shared once should be treated as shared.
Which option fits what you're trying to protect?
Phone settings and a passcode-protected link solve different problems. This is what each one actually covers.
| Option | What it protects | What it doesn't |
|---|---|---|
| Face ID or app lock on Messages | Your conversations from someone using your phone | The recipient's copy, cloud backups, synced devices |
| Hiding lock-screen previews | Text appearing on your locked screen | Anything once the phone is unlocked; the recipient's settings |
| Keep Messages: 30 days | Old texts piling up on your phone | The next 30 days; the recipient's phone |
| iMessage undo send | A text sent to the wrong person, if caught fast | Anything already read; SMS; non-Apple phones |
| Passcode-protected one-time link | The secret in both phones' history; anyone who sees the link without the passcode | Screenshots, or someone who gets both the link and the passcode |
| Password manager sharing | Ongoing access you can revoke later | Works only if both people use it |
For a one-off secret going to one person, the link wins. For keeping your own phone private, use the settings. Most people should do both.
What can still go wrong?
A passcode-protected link removes the biggest risk, which is the secret sitting in a thread forever. These are the mistakes that undo it.
Sending the passcode in the same thread
This is the most common one. If the link and the passcode sit next to each other, anyone who reads the thread gets both. A phone call is best. A different app is the next best thing.
Choosing the longest settings by default
Ten views and 30 days is fine for a recipe, not for a PIN. Every extra view and extra day is another chance for the wrong person to open it. Start at 1 view and the shortest time limit that works.
Leaving the secret in the surrounding text
The link protects only what's inside the note. If your text says the alarm code starts with 90, you've leaked part of it. Keep the message around the link generic.
The recipient screenshots it
Nothing stops someone from saving what they've read. Tell them where to keep it, such as a password manager or written down, rather than a screenshot that ends up in their photo backups.
Someone else opens it first
If your recipient taps the link and it no longer works, assume someone else opened it. The read notification helps here: if you get an email before your recipient says they've opened it, change the secret and send a new link.
Not changing the secret afterwards
A one-time link limits where the secret is stored, not who knows it. Temporary door codes, Wi-Fi passwords and shared logins should be changed once they're no longer needed.
For a broader look at these limits, read what a one-time secret link guarantees and what it doesn't.
When a passcode-protected link isn't the right tool
A link works best for a short secret going to one person, once. Some situations call for something else.
- A password you'll share for months. A family streaming login or a shared work account belongs in a password manager with sharing, so you can revoke access later.
- Paying someone. Use the vendor's payment link or portal rather than texting card numbers in any form.
- Files and photos. SecureNotes handles text only, up to 10,000 characters. It doesn't send attachments.
- A conversation that needs nuance. If the news is personal or needs back-and-forth, a phone call leaves no written trail at all.
- Just keeping your own phone private. If no one else needs the message, the phone settings above are all you need.
If your goal is specifically texting a login, this guide on sending a password over text message covers that case in more detail. For questions about how notes are stored and destroyed, see the SecureNotes FAQ.
Frequently asked questions
Can you lock a single conversation on iPhone?
Not with a separate passcode. You can hide alerts for one conversation so its messages don't pop up, and on iOS 18 and later you can lock the whole Messages app behind Face ID. Neither puts a password on one thread, and neither affects the other person's phone. To protect one specific message, send it as a passcode-protected link instead.
Does iMessage encryption mean my texts are password protected?
No. iMessage encrypts messages while they travel between Apple devices, but once delivered, anyone who can open the unlocked phone can read them. Encryption in transit protects against interception, not against a borrowed phone, a visible lock screen or an old backup. A passcode is a separate barrier that the recipient has to clear before seeing the content.
Is there an app that adds a password to text messages?
Apps that claim to lock texts usually lock the messaging app on your own phone, not individual messages. Secure messengers offer features like disappearing messages, but they still don't ask the recipient for a passcode per message. If you need the recipient to enter a passcode first, text a passcode-protected one-time link and share the passcode separately.
What should I use as the passcode?
Use something short enough to type easily on a phone but not guessable from your conversation. Avoid the recipient's name, birthday, your address or anything mentioned in the thread. A random word you agree on during a phone call works well. Deliver it by voice or through a different app, never in the same text thread as the link.
What happens if the recipient never opens the link?
If you set a time limit, the note is destroyed when it runs out, whether or not anyone opened it. SecureNotes offers 1 hour, 24 hours, 7 days or 30 days. Once that passes, the link stops working. Pick the shortest window that realistically fits, and send a fresh link if the person needs it later.
Can I unsend a text if I already typed the password into it?
Only in limited cases. iMessage lets you unsend for a couple of minutes between up-to-date Apple devices, but the other person may have already seen it or had it appear in a notification. SMS can't be unsent at all. If a password went out in a plain text, change the password, then share the new one through a passcode-protected link.
