Practical guide
How to Send New Employee Credentials More Safely
A simple workflow for delivering an initial password without putting it in the onboarding email.
Published: May 18, 2026
Current implementation boundary
Current Collogue links carry the encrypted payload in the URL. The browser uses Web Crypto API: PBKDF2-SHA-256 with 310,000 iterations derives a 256-bit AES-GCM key from the separately entered password, with a random 16-byte salt and a 12-byte IV. The current client has no application API request for creating, retrieving, or storing messages.
The password is not encoded in the link. The implementation does not provide one-time viewing, server-side deletion, or an expiry timer. Treat the full link as sensitive and share the password through a separate channel.
Further context
Direct answer: Verify the employee’s contact channel, create a temporary password that must change at first login, send it through a Collogue private link, require MFA enrollment, and revoke the credential if the link and password may have been disclosed.
Onboarding is a security ceremony performed under deadline pressure.
The employee needs access. IT needs the identity to be correct. HR needs the process to finish. Email is available, so the temporary password is often placed directly in the welcome message.
That works. It also creates a long-lived readable credential record.
A better process separates instructions from the temporary secret.
- the approved start date;
- the employee’s identity;
- the destination address;
- whether personal email is allowed by policy;
- the employee’s manager or sponsor;
- the systems they actually need.
Do not issue privileged access merely because it appeared in a forwarded onboarding spreadsheet.
The employee should never continue using the password delivered by IT.
- official login URL;
- username;
- start instructions;
- support contact;
- MFA enrollment steps;
- a reminder to keep the link and separately shared password private.
The Collogue message contains the temporary password.
For higher-risk environments, provide some context through the manager or another verified channel. Follow organizational policy rather than inventing an improvised ritual.
Your temporary password is in the private link below. Use the password shared separately, choose a new password after your first sign-in, and enroll in multi-factor authentication. If either part may have been disclosed, contact IT so we can replace the credential.
The employee should not have to understand ciphertext, URL fragments, or authenticated encryption to onboard safely.
Do not send permanent recovery codes in the same onboarding email unless policy requires it and the risk has been reviewed.
The target identity system should enforce this. Collogue controls message availability, not account validity.
Treat the temporary password as exposed.
- reset it;
- check for login activity;
- verify the employee’s address;
- create a new password;
- send a new private link;
- test the organization’s mail-scanner behavior if the issue repeats.
Because the password is temporary, replacement should be straightforward.
That is a design advantage, not an inconvenience.
- credential issued;
- link sent;
- recipient verified;
- first login completed;
- password changed;
- MFA enrolled;
- temporary access revoked.
It should not contain the password or full private link.
Good auditability records actions, not secrets.
- the employee receives administrative access;
- identity proofing is required;
- regulated systems are involved;
- approvals must be enforced;
- geographic or contractual controls apply;
- the organization has an approved onboarding platform.
Collogue can support delivery. It does not replace identity governance.
Only if organizational policy permits it and the address has been verified. Corporate policy may require a manager-mediated or identity-verified process.
No. Use a temporary bootstrap password and require immediate change.
Avoid placing all access factors in one delivery path. Follow the target system’s approved enrollment and recovery process.
Create a private Collogue link, require a first-login password change, and complete MFA enrollment.