Guide
How to send sensitive information over email
Email is one of the least private ways to send something private. Here's the safe way to do it.
Is email secure for sensitive information?
Email is one of the least private ways to send something private. People reach for it because it's familiar, but:
- Emails are permanent by design. They sit in your "Sent" folder and the recipient's inbox indefinitely, and both are backed up to servers you don't control.
- They're easy to forward and copy. Once sent, you have no say in where the information goes next.
- Inboxes get breached. Email accounts are a top target for hackers precisely because of everything sensitive people leave sitting in them.
That's a problem when you're sending things like an ID or passport number, a tax reference, a private medical detail, a confidential note, or account information for a form.
How to send sensitive info safely, step by step
- Open SecretDrop.
- Paste the sensitive part — the ID number, the private note, whatever shouldn't linger.
- Create the one-time link.
- Write your email normally and include the link where you'd have put the sensitive detail.
- The recipient opens the link once, reads the information, and it's permanently deleted. Your email is left holding only a dead link.
This way, even if either inbox is later compromised, the sensitive part isn't sitting there — it's already gone.
Best practices
- Keep the sensitive detail out of the subject line and body entirely — only the link goes in the email.
- Give the recipient a heads-up so they open the link promptly; links can also expire on a timer.
- Confirm the recipient's address is correct before sending — a link to the wrong person is still safer than raw info, but accuracy matters.
- For documents, share the key detail via the link and mention it separately, rather than putting everything in one place.
Frequently asked questions
Is it safe to send sensitive information over email?
Not on its own — emails are stored permanently and can be forwarded or exposed in a breach. Sending a burn-after-read link instead keeps the sensitive part out of the email entirely.
What's the safest way to send personal details?
Use a one-time link that reveals the information once and then deletes it, so nothing sensitive is left sitting in an inbox or message thread.
How do I send an ID or passport number securely?
Paste it into a burn-after-read link and email the link rather than the number. The recipient sees it once, then it's destroyed.
Can I unsend a sensitive email?
Usually not reliably — once it's delivered, it's out of your hands. That's exactly why it's better to send a self-destructing link than to put sensitive information in the email itself.