What to do if you sent a password to the wrong person: change that password immediately, sign out all other sessions, check or turn on two-factor authentication, and update any other account using the same password. Deleting the message helps but doesn't undo it, because the recipient may already have seen or copied it.
Key takeaways
- Change the password first. Deleting the message comes second because it can't undo what was already seen.
- Sign out of all other sessions, since a new password doesn't always kick out someone already logged in.
- Check that 2FA is on and that your recovery email, phone and devices haven't been changed.
- Change the password anywhere else you reused it, starting with your email account.
- Send the replacement as a one-time link with a passcode so a second slip can't expose it.
What to do if you sent a password to the wrong person: the first 10 minutes
Treat the password as compromised from the moment it left your hands. It doesn't matter whether the recipient is a stranger, a colleague or your mum. You can't prove nobody saw it, so assume someone did.
Work through these steps in order. The first two matter most.
1. Change the password now
Log in to the account and set a new password straight away. Make it completely new, not the old one with a digit changed. If it's a work account, use your company's reset process or ask IT to do it.
Do this from a device you trust, not a shared or borrowed one. NIST's digital identity guidelines say a password should be changed when there's evidence it has been compromised, and a misdirected message counts.
2. Sign out every other session
Changing the password doesn't always log out someone who is already signed in. Look in the account's security settings for “Sign out of all devices”, “Log out everywhere else” or a list of active sessions.
End every session you don't recognise. If you're unsure, end them all and sign back in on your own devices.
3. Check two-factor authentication and recovery details
If two-factor authentication (2FA) was on, the person holding your old password still needed your second factor to get in. That buys you time. If 2FA was off, turn it on now.
While you're in the settings, check the recovery email, recovery phone number and the list of trusted devices. An attacker's first move is often to add their own, so they can get back in after you change the password.
4. Change it everywhere else you used it
If the same password protects other accounts, those are exposed too. Change every one of them, starting with your email, because your inbox can reset almost everything else.
5. Look for activity you don't recognise
Check recent logins, sent emails, mail forwarding rules, new devices and, for money accounts, recent transactions. If anything looks off, contact the provider or your bank using the number on their website or your card, not a number from a message.
How urgent is it? It depends on who got it and what it opens
Not every slip carries the same risk, but every one needs at least step one. Use this to judge how far to go.
- Sent password in wrong chat with someone you trust (a colleague, a partner): change it anyway. The message now lives on their phone, in their backups and possibly in notifications on a shared tablet.
- Sent to a group chat or busy channel: assume several people saw it. Do the full checklist without delay.
- Sent to a stranger or a wrong number: treat it as fully exposed and work through every step.
- A work login or shared admin account: tell IT or security now. They may need to rotate related keys, check logs or reset things you can't reach.
- Lower-stakes codes like guest Wi-Fi or a key lockbox: still change them as soon as you can, especially when they guard a physical space.
Should you delete the message? Yes, but it isn't enough
Delete or unsend it if you can. That removes one copy and stops it turning up later in a search. But a password sent by mistake has usually been seen or stored somewhere before you notice.
Notifications show the text on a lock screen before anyone opens the chat. Phones and laptops back up conversations. Work tools may keep messages under retention rules after you delete them. And anyone can take a screenshot. We've written more about what goes wrong when secrets sit in chat history, but the short version is that deleting is tidying up, not a fix.
| Where you sent it | Can you take it back? | What may survive |
|---|---|---|
| SMS text | No. Deleting only removes your copy | Recipient's phone, notifications, backups |
| iMessage | Unsend works for about 2 minutes on recent iOS versions | Copies on older devices, notifications already shown |
| “Delete for everyone” within a limited time window | Notifications, recipient's backups, screenshots | |
| Slack | You can usually delete your own message | Workspace retention, exports, email or push notifications |
| Microsoft Teams | You can delete your own message | Retention policies, notifications |
| Gmail | Undo Send only lasts up to 30 seconds | The full email in the recipient's inbox |
| Outlook | Recall sometimes works inside the same organisation | Often fails for outside recipients or once the email is read |
So delete it, then carry on with the checklist. The new password is what actually protects you.
Should you tell the person who received it?
Yes, briefly. Something like “Sorry, that was meant for someone else. I've changed it, but please delete the message.” Keep it short and don't repeat any part of the password.
Most people will delete it, which removes another copy. And if they mention it went to a shared device or got forwarded, you know to watch your account activity more closely.
If it landed in a work channel, tell your manager or IT too. Admins can sometimes remove a message from everyone's view or from retention, which you can't do yourself.
Common mistakes that leave you exposed anyway
- Making the new password a tweak of the old one. If the old one was
Harbour2024!, thenHarbour2025!is the first thing anyone would try. - Changing the password but not ending sessions. Someone already signed in may stay signed in until you force them out.
- Forgetting the accounts where you reused it. The one you changed is safe. The three others with the same password are not.
- Sending the new password in the same chat. If others share the account, they need the new one, and the reflex is to paste it into the same thread. That recreates the exact problem.
- Ignoring app passwords and API keys. Some services let app-specific passwords or tokens keep working after a password change. Revoke and recreate them.
- Trusting the next message. If a stranger got your password, be wary of a follow-up claiming to be support and asking for a verification code. Never share a 2FA code with anyone.
How to send the new password safely, step by step
Once the password is changed, the right person still needs it. Instead of pasting it into a chat where it stays forever, send it as a one-time link that stops working after it's read.
- Go to SecureNotes and create a self-destructing note. Paste in the new password plus only what the recipient needs, such as which account it's for.
- Choose when it self-destructs. One view is the right choice for a password. Add a time limit as well, such as 24 hours, so an unopened link doesn't hang around.
- Add a passcode. If the link goes to the wrong place again, nobody can open it without the passcode.
- Turn on the read notification if you want an email when the note is opened.
- Create the note, copy the link and send it to the right person. Check the recipient's name before you press send.
- Send the passcode a different way, for example by phone call if the link went by WhatsApp, or by text if the link went by email.
Single-view is already the norm: SecureNotes data shows 70% of notes are set to self-destruct after one view. Only 18% add a passcode, yet the passcode is the setting that protects you if you misdirect a link. Our guide to passcode-protected notes and how to send the passcode covers which second channel to pick.
Worked example: a client password sent to the family group chat
Sam is a freelance web designer. At 9pm he meant to send the admin password for a client's WordPress site to his collaborator Priya on WhatsApp. Instead he pasted it into the family group chat, which has eight people in it.
Here's what he does, in order:
- He opens his laptop, logs in to the WordPress site and sets a new password generated by his password manager.
- In his WordPress profile he uses “Log Out Everywhere Else” to end any other sessions.
- He checks that the 2FA plugin is still active, that the site admin email hasn't changed and that no new admin users appeared.
- He uses “Delete for everyone” in the family chat and posts: “Wrong chat, ignore that. It's already changed.”
- He sends the client a short note saying a password was briefly exposed and has been changed.
Then he sends Priya the new password through SecureNotes. He picks 1 view and a 24-hour limit, whichever comes first, because Priya will log in tonight or tomorrow morning. He adds a passcode and turns on the read notification.
He sends the link to Priya on WhatsApp, checking the chat name first this time, and phones her with the passcode. Priya opens the link, enters the passcode and sees the password. After that one view the note is destroyed, so their WhatsApp chat only holds a dead link.
Sam gets an email saying the note was read. If Priya had found the link already used, they'd both know someone else had opened it, and Sam would change the password again.
How to avoid sending a password to the wrong person next time
- Stop pasting raw passwords into chat. Typing them into the same box you use for everything else is how they end up in the wrong thread.
- Use a password manager for ongoing access. If a colleague needs the same login every week, share it through a vault rather than resending it. Here's how to decide between one-time links and password vaults.
- Use one-time links for one-off handovers. A misdirected link with a passcode is useless to the wrong person, and an expired link is useless to everyone.
- Slow down at the send button. Group chats with similar names and email autocomplete cause most of these slips. Read the recipient name before sending anything sensitive.
- Keep 2FA on every important account. It turns a leaked password from a break-in into an inconvenience.
And sometimes the best channel is your voice. Reading a password aloud on a call leaves no written copy at all, as long as nobody nearby is listening.
Frequently asked questions
Can someone get into my account with just my password?
If two-factor authentication is off, yes. A username and password are all most services need. With 2FA on, they would also need your code or device, which makes a break-in much harder. Either way, change the password, because many people reuse passwords and the same one may open accounts that don't have 2FA.
Do I need to change my password if I sent it to someone I trust?
Yes. Trust isn't the issue. The message now sits on their phone, in their backups and possibly in notifications on shared devices. If their phone is lost or their account is compromised, your password goes with it. Changing it takes a few minutes and removes the risk entirely, so it's cheap insurance.
What if I typed my password into a scam message or fake website?
Treat it as stolen. Change the password on the real site by typing the address yourself, sign out all sessions and check 2FA and recovery settings. If it was a bank or card login, call your bank using the number on your card. Report the scam to the platform where it reached you.
Should I tell IT if I sent a work password to the wrong person?
Yes, and quickly. IT can reset the account, check sign-in logs, remove the message from shared channels and rotate any related credentials you might not know about. Most security teams would much rather hear about a mistake within minutes than discover it weeks later during an audit. Reporting it is the professional move, not an admission of failure.
What if I sent a one-time link to the wrong person instead?
If the note has a passcode, the wrong person can't open it without that passcode, so make sure it didn't go to them as well. If there's no passcode, assume it may have been opened. Ask the intended recipient whether the link worked; if it was already used, change the password and send a fresh link.
