QR Text
ENPT
Back to blog
securitydevelopment

How to share API keys safely without using WhatsApp

Sending tokens, passwords and API keys through WhatsApp is the most common — and the worst — way security-wise. Here are four alternatives that leave less trace.

April 22, 20263 min readby PasteQRCode

Every developer has been there: a teammate asks "send me the staging API key?" and, without thinking, you paste sk_live_abc123... into WhatsApp. It works, but it's the worst possible practice — that key is now in both of your WhatsApp histories, synced to Meta's servers, indefinitely, and probably in cloud backups too.

Why WhatsApp is bad for credentials

Three main reasons:

  1. Persistent history: even if you delete the message, copies on the other phone and in backups stick around.
  2. Multi-device sync: WhatsApp Web, WhatsApp Desktop, WhatsApp Business — the key can be in 4-5 places simultaneously.
  3. Compliance: if your company has ISO 27001, SOC2, or GDPR obligations, passing credentials in personal chat is an immediate non-conformity.

Alternatives from worst to best

1. Corporate email (acceptable for non-production keys)

At least corporate email passes through DLP filters and lives on auditable infrastructure. But email is also persistent — and more exposed to phishing.

2. Password in Slack/Teams with 👁️ reaction (to delete later)

Better than WhatsApp because you can configure short retention. But still leaves traces on the platform's servers.

3. Shared password manager (1Password, Bitwarden)

The correct approach for persistent tokens. Share the item, the other person uses it without copying. Ideal for credentials that will be used many times.

4. Local QR Code + self-destruct (for one-off use)

For the "I need to send this key right now, just once" situation, generating a browser QR Code with a self-destructing link is the cleanest option. The flow:

  1. Paste the key into a generator like PasteQRCode.
  2. If the text is short (< 300 chars), the QR contains the key directly — nothing touches a server.
  3. If it's long, the generator saves it to a temporary store for 5 minutes and emits a short link.
  4. The other person scans the QR, sees the key, copies it to their password manager.
  5. In 5 minutes, the link self-destructs.

The strong advantage: the QR Code doesn't go through any chat, email, or corporate cloud. No log, no backup, no history.

Best practices regardless of method

No matter which channel you use, follow this:

  • Rotate after: any credential that travelled through any channel should be rotated as soon as possible.
  • Use least-privilege keys: never send a root / admin key if a read-only or scoped one would work.
  • Prefer short TTL: 1-hour tokens > eternal tokens.
  • Avoid screenshots: cameras and Lightshot-style tools save images to the cloud.

FAQ

Is a QR Code actually secure? The QR itself isn't encrypted — whoever sees the screen or the photo sees the content. But compared to WhatsApp, it leaves no persistent history. Use it in environments where you control who's watching.

What if the person takes a photo of the QR? Real risk. For truly sensitive credentials, a password manager is still the right answer.

Does it work for Pix keys or crypto wallet seeds? It works, but for real monetary value, use strong auth. A local QR is great for low-risk one-off transfers.

Summary

For persistent credentials: password manager. For a one-off key share with no history: local QR Code with self-destruct. For anything production-adjacent: rotate after sharing, regardless of channel.

WhatsApp for credentials is comfortable, but it's security tech debt. Any audit will find it.

Keep reading