Share logins and access safely

Sooner or later someone needs access to one of your accounts: a developer, a designer, a new colleague or an agency like us. This article shows how to give that access without emailing passwords, and how to take it back when the work is done. It works for any tool, with examples for the ones we use most.

Never email a password

A password in an email, WhatsApp message or shared document is hard to take back.

• Messages stay in inboxes, backups and chat histories for years, and they get forwarded.
• If one of those inboxes is hacked, your password is exposed too.
• When several people share one login, you cannot see who did what.
• To remove one person, you have to change the password for everyone.

Best option: invite people with their own login

Most tools let you invite people by email. They get their own account, their own password and their own two-factor authentication. You choose what they can do, and you remove them with one click.

1. Find the users, members or team section in the tool’s settings.
2. Invite the person with their own email address.
3. Give them the most limited role that lets them do the job. You can always upgrade it later.
4. Write down who you invited, where, and with which role.

Here is where to look in tools we often work with:

Tool	How to give access
Google Workspace	In the Admin console, give a limited admin role instead of super admin. For Analytics, Search Console or Tag Manager, add the person’s own Google account as a user. To let someone handle a mailbox, use mail delegation instead of sharing the password.
Netlify	Invite them to your team and pick a role that fits. Keep owner rights for people in your own company.
n8n	Invite them as a user from the settings, preferably not as owner or admin. Share only the workflows and credentials they need.
Domain registrar	Many registrars let you add a user or give access to a single domain. If yours does not, share the login with a password manager (see below).
Stripe	Invite them as a team member with a limited role, not Administrator. Developers rarely need access to payouts or bank details.

Warning: The owner of every account should be someone in your own company, not a freelancer or agency. That includes your domain, Google Workspace and Stripe. If the person who set it up leaves, you still own everything.

When you must share a password: use a password manager

Some services have no team feature. In that case, share the login through a password manager such as 1Password or Bitwarden, never in a plain message.

• 1Password: you can share a single item through a secure link. You choose who can open it and when the link expires.
• Bitwarden: put the login in a shared collection within your organisation, or use Bitwarden Send for a one-off share with an expiry date and an optional password.

1. Save the login in your password manager.
2. Share it with the sharing feature, with the shortest expiry that works.
3. Tell the person through a different channel that the link is coming.
4. Change the password when the work is done.

Turn on two-factor authentication

Two-factor authentication (2FA) asks for a second proof, such as a code from an app, on top of the password. A leaked password alone is then not enough to get in.

• Turn it on for every account that offers it. Start with email, your domain registrar, Stripe and your hosting.
• Use an authenticator app or a passkey where possible. They are safer than codes by text message.
• Store the backup codes somewhere safe, such as your password manager.

Tip: If a shared login keeps asking for a code that only arrives on one person’s phone, that is a sign the other person should have their own login. If sharing really cannot be avoided, some password managers can store the 2FA code in the shared item.

Remove access after a project

When a project ends or someone leaves, clean up straight away.

1. Go through your list of who has access to what.
2. Remove the person, or lower their role, in every tool.
3. Change every password you shared, and delete any share links that are still active.
4. Check for API keys, app connections or webhooks created for the project. Remove the ones you no longer use.
5. Check that the account owner, recovery email and recovery phone number are all yours.

Note: Removing access is not a sign of distrust. Any good partner expects it and will help you check that nothing is left.

Next steps

• Get help fast
• Connect your apps with credentials
• Memory, privacy and your data
• Invoices and payments in the customer portal