How to share passwords with staff safely

Somebody on your team needs the login for the company Facebook page, the bank portal or the domain account. You are busy, so you paste it into WhatsApp. It takes ten seconds, and it works.

It also leaves that password sitting in a chat, on a phone, maybe on a laptop you have never seen, for as long as the chat exists. This guide explains how to share passwords with staff safely, in plain English, and what to do when the people who know them move on.

Why shared passwords go wrong

The UK’s National Cyber Security Centre (NCSC) is direct about this. Sharing work accounts, or even occasional use by anyone other than the account owner, brings risks. People may reach things they should not. And when several people use one login, you can no longer tell who did what. The NCSC points out that this ability to audit a specific person’s actions is lost, which matters a great deal when something goes wrong.

In small businesses the real problems are usually more ordinary:

• The password sits in a chat or an email, where it stays readable for years.
• It lives in a spreadsheet that is itself shared with more people than anyone remembers.
• Nobody knows exactly who has it today.
• When a staff member leaves, nobody changes it, because nobody wrote down where it is used.

Step 1: ask whether you need to share at all

Before you share a password, check whether the account lets you give someone their own access. The NCSC advises using delegation instead of sharing wherever possible. Delegation means giving another person’s own account permission to reach something, such as a shared inbox, a document or a page, so they sign in as themselves.

Many tools you already use can do this: Google Workspace and Microsoft 365 for mailboxes and files, social media platforms for page roles, and hosting and domain companies for extra users. It is a few extra minutes of setup, and it gives you two things sharing never will: each person has their own login, and you can remove one person without touching anyone else.

Step 2: if you must share, share through a password manager

Some accounts only have one login: a bank portal, a supplier site, a software licence. For these the NCSC says that if you have a business need to share a password, you should consider a password manager. It notes that some password managers let you share a password more securely, for example by recording who has access and by keeping changed passwords in step for everyone.

A password manager is an app that stores your passwords in an encrypted vault, creates strong ones for you and fills them in. The shared part is a vault or folder that only the people you choose can open. The password itself is never typed out or pasted into a chat. If you want a refresher on whether these apps are safe to trust, read our guide on whether password managers are safe.

Step 3: share with the smallest group that can do the job

The NCSC gives a simple rule for the cases where sharing cannot be avoided: share the password only within the smallest possible group of known and trusted people, and do not expose it to anyone who is not allowed to use it. Applied to a small business, that looks like this:

1. Sort accounts by risk. Money, email, your domain and your website hosting come first. A free design tool can wait.
2. Give each person only what their job needs. The person who posts on social media does not need the bank login.
3. Keep a list of who has what. In a password manager this is built in. On paper or in a spreadsheet it goes out of date within a month.
4. Turn on two-step verification where you can. Two-step verification means a login also needs a code from an app or text message. The NCSC calls multi-factor authentication one of the most effective extra protections for an account, because a stolen password alone is not enough. Ask who receives the codes for a shared account: it should not be a personal phone of someone who may leave.

Step 4: what to do when someone leaves

This is where most businesses are caught out. The NCSC is clear on the principle: if someone is no longer allowed access to a shared password, the password should be changed. Removing a staff member’s email account does not do that. They may still know the bank login, the hosting login and the social media password.

A leaver checklist for passwords, in plain terms:

1. List every shared account the person could open. If you cannot list them, that is the problem to fix first.
2. Change the password on each one, starting with email, money and your domain.
3. Check who receives the two-step codes, and move them to a business-owned device or number.
4. Remove their access to the password manager or vault, if you use one.
5. Write down the date you did all this.

What not to do

• Do not send passwords in chat apps or email unless there is truly no other way, and then change the password afterwards.
• Do not keep them in one shared spreadsheet or note that anyone with the link can open.
• Do not use one password for several accounts. The NCSC warns that when you reuse a password and one account is compromised, an attacker can try the same password on your other accounts.
• Do not force staff to change passwords every few weeks. The NCSC says forced password expiry carries no real benefit, because people tend to choose small variations of the old password. Ask for a change when you suspect a problem, or when someone leaves.

A simple plan for this week

1. Write down the ten accounts that would hurt most to lose.
2. Next to each one, write who really needs access.
3. Ask whether any of them can be handled by giving staff their own login instead of a shared one.
4. Move the rest into a password manager and delete the chat messages and spreadsheet copies.
5. Change the passwords that were in chats, because they have already been exposed to everyone who could see that chat.

Want help doing this properly?

Moving a team over is not hard, but it is easy to half do. A password manager that only the technical person uses solves nothing. If you want it done across the whole team, with the old passwords moved out of chats and the exposed ones changed, see our heylogin password management service. To see what a long, random password looks like, try the free password generator.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Password policy: updating your approach, section on managing shared access, National Cyber Security Centre (UK). Source for the risks of shared accounts, using delegation instead of sharing, sharing with the smallest group, changing a password when someone loses access, using a password manager to share, multi-factor authentication, and forced expiry having no real benefit.
• Managing your passwords, National Cyber Security Centre (UK). Source for the risk of reusing a password across accounts and for what a password manager does.
• Use Strong Passwords, CISA (US). Source for using a password manager to create and store long, random, unique passwords.