I am a web developer who often takes over clients' current website. The clients often send me their CPanel password via email. I know this is bad, but I don't know a safe alternative.

This is what I've come up with...

  1. I have created a 'credentials' form on my dedicated, SSL encrypted server which accepts ONLY the password (no reference to domain or username which I ask for over email)

  2. The form posts the password to my php script which encrypts the password with aes-256-ctr and saves it to a write only directory below the server public dir. The filename will be the client's random, no sequential id number so I can then match it with the domain.

  3. I then SCP the file to my machine and immediately delete it from the web server. No passwords will be kept on here.

  4. I save the password in an encrypted password store on an encrypted USB stick.

I know fundamentally, because the password can be decrypted its not 100% secure, but it is critical that I am able to eventually read this password as plain text.

Can I do this better?

  • 4
    Why don't your clients setup a new account for you? Or just use encrypted (e.g. PGP) E-Mails? – Jonas Köritz Aug 3 '17 at 9:12
  • You can improve it by not using a USB stick (which can be lost) but placing the DB encrysption key on a HSM or smart card. – Stephane Aug 3 '17 at 9:48
  • @JonasKöritz I agree with the new account thing but I also I understand where he comes from regarding PGP: trying to force customers to use it (or S/MIME) is a waste of time and energy 99% of the time. – Stephane Aug 3 '17 at 9:51

If you're using a symmetric encryption, like AES, then the server can decrypt them since symmetric cipher uses the same key for encryption and decryption.

One improvement is to use asymmetric encryption like PGP. You can put the public key in the server, which allows the server to encrypt messages from clients, you'll then download the encrypted messages and decrypt them with the private key on your own machine.

Even better is if your clients would encrypt against your public key themselves, so the server never handles the plaintext even momentarily (it can even be any regular mail server), doing this correctly is much trickier than it looks but it's the most secure when done right.

For practicality though, I'd suggest using an online password manager that has password sharing feature, like Lastpass.



First off, what passwords are you attempting to collect? If it is SSH access, you and your clients SHOULD be using pubkey anyway. In the case of pubkey you could give them your public key and ask that they add it to there .ssh/authorized_keys file.

If this is FTP access ... well the password is being xfered in clear text anyway, so maybe dont use FTP.

If this is a web portal like a login on a wordpress site ... they should really make an account for you and give you access.

Shared passwords are NEVER a good idea. Even if you dont do anything malicious, that same client could have his bank account hacked and since they use the same password for everything ... and you are the only other person that knows it ...

just dont

  • OP says in the question that it is the CPanel password. – mikeazo Aug 3 '17 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.