Best way to securely communicate passwords and credentials to clients?

If I am the sole admin in an organization and nobody else has the technical skill or inclination to manage the systems my personal preference is to demonstrate that the passwords work, then give them to the client on paper, in a break-open box (I use KeySure boxes http://www.keysure.net/keycontroller.html).

If I am hit by a bus, quit, or get let go all they need to do is break open the box and they have all the passwords I've set/changed.
If I'm still around and I notice that the key box has been broken open I know someone has the passwords who shouldn't (or someone who should have them is touching stuff without telling me) -- This offers some protection from well-meaning folks trying to "fix" a problem and destroying a stable environment.


In larger companies like the one I'm at now the back of our Site Operations book contains a page of (PGP-Encrypted) passwords for stuff that does not use key-based authentication. The passwords are accessible to the C-level officers of the company, as well as the senior admins & developers, either by cutting and pasting from a PDF of the Site Ops book or in the absolute worst case by carefully re-typing the encrypted block.


You could use something like a password-protected .ZIP file through http://drop.io with a one-time download and expiry date. You could call and give them the password for the zip and dropbox over the phone and email them the link.

I've also text messaged or phoned half of the password, email the other half, or some combination of both.


Since it looks like you've rephrased your question, if you're on-site, I would grab a copy of KeyPass and install it on a USB key or on their server. It uses Blowfish encryption, doesn't require installation, and can store all of their passwords in one secure place.