The usual way, pasting it into a chat or an email, leaves a copy sitting there for years. Here are the better options, from best to worst, and when each one makes sense.
When you send a password in a chat, it doesn't just reach the other person. It stays in your history and theirs, in cloud backups, on every linked device, in notification previews, and in any screenshot someone took and forgot about. Months later it is still searchable by anyone who gets into either account.
The goal isn't a perfect channel. It is to make sure the secret stops existing in readable form soon after it has been used.
If you and the other person already use the same manager (1Password, Bitwarden and others have sharing), use it. Access can be revoked and the secret stays in a vault. The catch is that both sides need the same tool, which is often not true for a client, a contractor, or a family member.
You write the secret, the tool encrypts it in your browser, and you send a link. The person opens it once, reads it, and the stored copy is deleted. Nothing is left in the chat except a link that no longer works. This is the best option when the other person has no account and no special software.
Send the username in one place and the password in another, or send a link by email and the opening password by phone call or SMS. An attacker now has to compromise two channels instead of one.
Over a phone call or in person. Fine for short secrets that can be remembered, and it leaves no written trace, but it doesn't work for long keys or recovery codes.
Encoder does the encryption in your browser using AES-256-GCM, before anything is sent. The decryption key is placed in the part of the link after the #. Browsers never send that part to a server, so the server only stores encrypted data it cannot read. When the link is opened, the data is delivered once and deleted from the server at the same moment. A second visit shows "message unavailable".
You can also protect the message with an extra password. In that case the link alone is not enough: the recipient needs the password too, and you should send it through a different channel than the link.
Send a one-time link in under a minute. No account needed to open it. Receiving is free, and you get a few free sends to try it. After that it is a one-time $19.99 license, with no subscription.
Open EncoderNo tool can fix everything, so here is what to keep in mind:
The transport is encrypted, but the message stays in both histories and backups. Sending a one-time link instead means there is nothing readable left afterwards.
Yes, whenever you can. Ideally the other person changes it on first login, so the version that traveled is no longer valid.
Then the recipient got it, or someone else did. If the recipient says it shows "unavailable" and they hadn't opened it, assume it was intercepted and rotate the secret.