To send a password in Microsoft Teams safely, don't paste the password into the chat. Put it in a one-time, self-destructing link, paste only the link in Teams, and send any passcode through a different channel. Teams messages are retained and searchable through Microsoft Purview eDiscovery, so a pasted password can outlive the conversation.
Key takeaways
- Teams is encrypted and access-controlled, but chats are kept as business records that compliance tools can search and export.
- Deleting or editing a Teams message usually doesn't remove the copy held under a retention policy or legal hold.
- Paste a one-time link instead of the password, so a later search only finds a dead URL.
- Send the passcode by phone or text, never in the same Teams chat as the link.
- For credentials a team uses every day, a password manager beats any chat message or link.
Is Teams chat secure for passwords?
Against outsiders, Teams holds up well. Messages are encrypted in transit and at rest, and access sits behind your Microsoft 365 sign-in and whatever multi-factor rules your IT team enforces.
That isn't the issue. Teams is designed to keep records. Your organization can retain chats for years, search them and export them, and that's exactly what compliance teams want it to do.
So the honest answer is this: Teams is secure for conversations, not for storing secrets. Pasting a password into a chat is storing it, right next to lunch plans and project updates.
Where does a password go after you send it in Teams?
Following one message through Microsoft 365 explains why "I'll just delete it afterwards" rarely works.
Into your organization's compliance store
Teams copies chat messages into Exchange Online mailboxes for compliance purposes. That copy isn't something you see in Outlook, but it's what Microsoft Purview tools search.
Into eDiscovery and content search
Anyone with eDiscovery permissions in your tenant, such as compliance officers, some IT admins, or outside counsel during a legal matter, can search every chat for terms like "password", "pw:" or "login" and export the results. Auditors run exactly these searches, which is why your IT audit will find credentials sitting in your chat logs if they're there.
Into retention, even after you delete it
If your organization applies a retention policy or places a mailbox on legal hold, deleting or editing the message in Teams only removes it from view. The preserved copy stays until the retention period ends, which can be years.
Onto every device and person that can see the chat
The password also lands on the recipient's laptop and phone, in lock-screen notification previews, and in the history of a group chat that someone may join next month. If your organization uses Microsoft 365 Copilot, it can draw on chat content a user has access to when answering questions, which is one more place a stray password can resurface.
How to send a password in Microsoft Teams with a one-time link
The fix is to let Teams carry a pointer, not the secret. A one-time link opens once and then stops working, so what a compliance search turns up later is a URL that leads nowhere.
- Paste the password into a note. Go to SecureNotes and create a self-destructing note. Paste only the credential itself, for example the username and temporary password. Keep the context ("here's the vendor portal login") in your Teams message.
- Choose when it self-destructs. For a single recipient, 1 view with a 24-hour limit is a sensible default. The note is destroyed after whichever comes first, and the link stops working.
- Add a passcode. It's optional, but use one for admin accounts, shared mailboxes, or anything posted where more than one person could click the link.
- Paste the link into Teams. Send it in a 1:1 chat with the person who needs it, not in a channel. If Teams builds a preview card for the link, you can remove the card before you hit send.
- Send the passcode another way. Call them, text them or tell them in person. Putting the passcode in the same Teams chat puts both halves in the same searchable record.
- Confirm and clean up. Turn on the read notification so you get an email when the note is opened. If it's a temporary password, require a change at first sign-in so the value you sent stops mattering quickly.
Each note is encrypted with AES-256 using its own random key before it's stored. If you provision lots of accounts, the free SecureNotes REST API lets a script create the note and hand you the link, so nobody copies passwords around by hand.
Teams chat vs other ways to share a password
Here's how the usual options compare for someone on Microsoft 365.
| Method | What stays in searchable records | Best for |
|---|---|---|
| Password pasted in Teams chat | The password, for as long as retention applies | Nothing sensitive |
| Pasted in Teams, then deleted | Often the password, if a retention policy or hold applies | Not a fix |
| Outlook email | The password, in both mailboxes | Low-risk information only |
| One-time link in Teams | A link that no longer works | One-off handoffs: temporary passwords, vendor logins, Wi-Fi codes |
| One-time link plus passcode by phone | A link that no longer works | Admin and high-value credentials |
| Password manager shared vault | Nothing in chat | Credentials a team uses every day |
| Phone call or in person | Nothing written down | Short passwords and urgent fixes |
The same logic applies to other workplace chat tools. If half your company lives in Slack, see how to send a password over Slack without leaving it in history.
When a one-time link isn't the right tool
One-time links are for handoffs. Some situations call for something else.
Credentials the team uses repeatedly
If five people log into the same supplier portal every week, sending it five times is the wrong pattern. Put it in a password manager's shared vault, where you can grant and revoke access without the secret ever appearing in a chat. This breakdown of one-time links vs password vaults covers where the line falls.
New user accounts in Entra ID
For new hires, set a temporary password that must be changed at next sign-in, or use a Temporary Access Pass if your tenant supports it. You can still deliver that temporary value with a one-time link, but the forced change does most of the protective work.
Application secrets and service accounts
Connection strings and service credentials belong in a secrets store such as Azure Key Vault, read by the application directly. Passing them between people, by any channel, should be the exception.
When policy requires a record
Some regulated teams must keep a record of what was shared. Follow your organization's approved process, and ask your security team which tool they want you to use.
Common mistakes when you share a password in Teams
Most leaks come from small habits, not clever attacks.
- Sending the passcode in the same chat. If the link and the passcode sit one message apart, the passcode adds nothing.
- Editing the message to remove the password. Teams may preserve earlier versions of edited messages for compliance, so the original can still turn up in a search.
- Splitting the password across two messages. It feels clever, but eDiscovery exports the whole conversation, and both halves arrive together.
- Posting in a channel. Channel messages are visible to every current member and anyone who joins later. Use a 1:1 chat.
- Setting 10 views and 30 days "just in case". The longer a link lives, the more chances it has to be opened by the wrong person. If the recipient misses it, send a fresh one.
- Ignoring a link that's already been opened. If your recipient says the note was gone before they got to it, assume someone else saw it. Change the password and send a new link rather than resending the same value.
- Copying the password somewhere permanent. A recipient who pastes it into OneNote or takes a screenshot recreates the problem you just avoided. Ask them to save it straight into a password manager.
What to do if you already pasted a password in Teams
It happens to everyone. Here's the order that actually reduces risk.
- Change the password. This is the only step that fully fixes it. Once the old value is dead, every retained copy is harmless.
- Delete the message. It won't touch retained copies, but it stops casual exposure on screens and devices.
- Check where else it went. Was the chat forwarded, screenshotted, or open on a shared screen during a meeting?
- Tell IT or security if it was a privileged account. Ask them to review sign-in logs for that account and confirm multi-factor authentication is enforced.
- Send the new password properly. Use a one-time link, with the passcode sent by phone or text.
Frequently asked questions
Can my IT admin read my Teams chats?
Not casually through the Teams app, but admins and compliance staff with eDiscovery or content search permissions in Microsoft Purview can search, review and export chat messages across the organization. Access is usually logged and limited to specific roles, yet any password in a chat is reachable by those roles. Treat every Teams message as something a reviewer could read later.
Does deleting a Teams message remove it permanently?
Not always. Deleting a message removes it from the chat for participants, but if your organization has a retention policy or a legal hold, a preserved copy stays in the compliance store until the retention period ends. Without retention policies it may be removed sooner. If the deleted message contained a password, change that password regardless.
Are Microsoft Teams chats end-to-end encrypted?
Standard Teams chat messages are encrypted in transit and at rest, but they are not end-to-end encrypted. Microsoft 365 processes and stores them so features like search, retention and eDiscovery work. Teams offers end-to-end encryption for certain calls, which doesn't change how chat messages are stored or searched by your organization.
Is it safe to send a password to someone outside my company in Teams?
It's riskier than an internal chat. Messages with external or guest users can be kept under your organization's retention rules and the other organization's too, so the password may sit in two compliance systems you don't control. Send a one-time link instead, and share any passcode by phone or text.
How long should a one-time password link stay active?
As short as the recipient realistically needs. For a colleague who is online now, 1 view and 1 hour works well. For someone in another time zone, 1 view and 24 hours is a reasonable balance. Avoid 7 or 30 days for passwords, since a long-lived link is more likely to be opened by the wrong person.
Is emailing a password through Outlook safer than Teams?
No. Outlook email lands in the same Microsoft 365 compliance system, gets retained and is searchable through eDiscovery, and it stays in both the sender's and recipient's mailboxes. Email can also be forwarded outside the company in one click. The same fix applies: send a one-time link and deliver any passcode separately.
