How to Share Secrets Securely on Slack (Without Leaking Them)

"Can you Slack me the database password?"

It's a common request, but replying with the password itself is a security mistake. Slack retains message history, meaning that password now lives forever in:

1. Chat Logs: Searchable by anyone in the channel.
2. Notification Previews: Visible on lock screens.
3. Third-Party Apps: Scraped by any bot with history permissions.
4. Admin Exports: Visible during compliance audits or eDiscovery.

Here is the secure workflow for sharing credentials on Slack.

The Right Way: Use an Ephemeral Link

Instead of sending the secret, send a key to the secret that works only once.

Step 1: Encrypt the Secret

Go to SnapPwd.io. Paste the password, API key, or sensitive note into the secure text area.

Step 2: Generate a One-Time Link

Click Encrypt. This happens entirely in your browser using AES-GCM encryption. The server never sees the raw secret.

Step 3: Share on Slack

Copy the generated link (e.g., snappwd.io/v1/...) and paste it into your Slack conversation.

"Here is the credential: [link]"

Step 4: Verification (Optional)

Once your teammate clicks the link, the secret is revealed to them and immediately deleted from the server. If anyone else (or a bot) tries to click it later, they will see a "Secret not found" message.

Why This Works

By decoupling the secret from the delivery channel (Slack), you ensure that Slack never holds the sensitive data. Even if your Slack workspace is compromised years later, the attacker will only find dead links.

Pro Tip: Using the CLI

For developers who live in the terminal, you can do this without leaving your workflow:

# Install the CLI
npm install -g snappwd-cli

# Pipe your secret to Slack
echo "my-super-secret-password" | snappwd | pbcopy

Then just Cmd+V into Slack.