How to secure a Zoom meeting with passcodes and Waiting Rooms
A Zoom invitation can carry its passcode in the link. Use a generated meeting ID, screen guests in the Waiting Room and limit screen sharing, with settings checked against guidance available by 14 May 2020.
5 min read
- Author
-
-
- Published
- Reading time
- 5 min
If you are hosting a Zoom meeting in May 2020, set up access before you send the invitation. A passcode can stop someone who lacks the meeting details; a Waiting Room lets you decide who enters; and host-only screen sharing limits what a participant can display. Those controls solve different problems, so use them as layers rather than treating one setting as a guarantee.
This guide reflects Zoom features and account defaults documented by 14 May 2020. Defaults can differ by account type, and an organisation administrator may control which settings you can change. Check the actual meeting details before sending an invite.
Give a one-off meeting its own ID
For a scheduled one-off call, use the automatically generated Meeting ID rather than reusing your Personal Meeting ID. Zoom's 14 April product update said newly scheduled meetings and webinars would receive random 11-digit IDs, while a Personal Meeting ID would stay the same. A generated ID gives each event a separate address; it does not make the invitation private on its own.
Treat the whole invitation as sensitive
Zoom's passcode settings make joining convenient: by default, the passcode is embedded in the meeting link, so an invitee who clicks the link is not asked to enter it again. That means anyone who gets the complete link also gets the passcode. Send invitations directly to the people who need them, and do not post a meeting link on an unrestricted public page. The FBI gave the same advice in its 30 March teleconference-hijacking notice.
For free Basic accounts, Zoom's May 2020 changes took effect on 9 May: passcodes were required for meetings and webinars, the Waiting Room was enabled by default for Personal Meeting IDs, and screen sharing defaulted to host only. If an older Basic-account invitation appears to have no passcode, check the meeting details; Zoom's guidance recommends scheduling a new meeting and sending an updated invitation when an existing one lacks a passcode. Other account types and managed accounts may have different defaults, so verify the event you are about to host.
Use the Waiting Room as a checkpoint
Zoom's Security icon gives hosts and co-hosts access to controls including the Waiting Room, meeting lock, participant removal and restrictions on sharing. If you expect a closed group, admit people individually and compare the names with your attendee list. Ask someone you do not recognise to identify themselves through a contact route you already trust, or leave them waiting.
A displayed name is not proof of identity. The Waiting Room gives you a chance to decide whether to admit a person; it does not authenticate them. Avoid admitting everyone automatically when you cannot match the names to the people you invited.
Keep screen sharing host-only unless guests need it
The FBI recommended setting Zoom screen sharing to Host Only. That is a useful default for a lecture, briefing or small meeting where attendees only need to watch. If someone must present, allow participant sharing for that part of the meeting and restrict it again afterwards. The Security controls let the host change what participants can do during a call.
Lock the meeting after the group arrives
When the expected attendees are inside, the host can use Zoom's Security controls to lock the meeting. Do not lock it before someone who is meant to attend has joined; decide how late arrivals should contact you first. If an uninvited person gets through, remove them, return sharing to host-only and lock the meeting once the attendee list is right. If the meeting link has been posted publicly, end the exposed meeting, create a new one with a fresh ID and send the replacement invitation directly.
Encryption and admission are different controls
Zoom 5.0 became available on 27 April and supported 256-bit AES-GCM encryption. In its announcement, Zoom said system-wide account enablement was scheduled for 30 May 2020. The release also added an encryption-status shield, but that status is separate from admission: encryption does not control who has the invitation or whom the host admits. Keep the Waiting Room and link-sharing controls in place.
A short host check before sending the invite
- Schedule a one-off meeting with a generated Meeting ID, then confirm that it has a passcode.
- Send the complete invitation only to the intended attendees. Treat the link as sensitive because it may contain the passcode.
- Check that the Waiting Room is on if you want to approve guests, and leave screen sharing set to Host Only unless attendees need to present.
- At the meeting, admit people you can identify. Lock the meeting after the expected group has arrived, and keep a way for late attendees to contact you.
Sources and further reading
- FBI, “FBI Warns of Teleconferencing and Online Classroom Hijacking During COVID-19 Pandemic” (30 March 2020)
- Zoom, “New Security Toolbar Icon for Hosts, Meeting ID No Longer Displayed” (8 April 2020)
- Zoom, “Enhanced Password Capabilities for Zoom Meetings, Webinars & Cloud Recordings” (14 April 2020)
- Zoom, “It's Here! 5 Things to Know About Zoom 5.0” (27 April 2020)
- Zoom, “May 2020: Passcode and security settings”
