This is not meant as a solution. It's a demo of a self-contained, self-extracting, portable encrypted file.

That said, the password strength and the strength of the side-channel to transmit it depend on your use case.

If we were friends for example, I may not need to send you a password at all. I could just add some secret questions we both know in the hint.

Or, at the opposite side of the spectrum, I could send you a secret as email attachment and *include the password in the email itself*. This adds zero security in certain scenarios, but for example it keeps Google bots out of your private correspondence. Which is all I want sometimes.