
If sending to a recipient outside of the company, however, the email contents will flow across public networks. The next step is to send the invitation out if all recipients are within your own company domain, then this is probably secure, as the internal IT team is in control. At this point the obfuscation of the password seems pointless and offers no security value. Pointing out the obvious here: the password’s encoded and plain versions are both included in the same invitation that is typically sent, in its entirety, as a calendar invitation or email to the invitee. The random string is an encoded version of the password, which is listed in its plain form below the Meeting ID. Notice the URL in the invitation in Figure 2 to “Join Zoom Meeting” includes a “pwd=” parameter followed by numerous seemingly random characters. Zoom invitation email with a default, random password
