Use a different channel
The simplest improvement is to send the passphrase somewhere else. That can mean sharing the link by email and the passphrase by text, phone, or a separate chat.
Keep the passphrase practical
A passphrase that the recipient will mistype three times is not helping anyone. Choose something that is clear enough to relay accurately but not obvious enough to guess from context.
Do not bury it in the same thread
If the link and the passphrase sit next to each other in the same visible message chain, the extra layer is weak. In that case, the passphrase has mostly become ritual.