Shared accounts

Grace, the finance and admin officer at a women’s rights organisation in Kampala, is the one who knows the logins: the bank portal, the fundraising platform, the organisation’s email. When a colleague needs one, she sends it on WhatsApp. Scrolling back through the team chat one day, she finds a dozen passwords, and a former intern still in the group.

Most small organisations share logins like this, in a chat or through one person who holds them all. This guide moves them somewhere safer, one account at a time, and covers what to do when someone leaves.

Why shared logins go wrong

A charity in England described where it started:

When I first started three years ago, staff used to all log in with just one account. And those passwords barely got changed unless somebody forgot it.

A charity in England, interviewed for the UK government’s Cyber security breaches survey 2025/2026

Every copy of a password is like a spare house key handed out. It can be lost, and unlike a key it can be used from far away without anyone noticing (Security in a Box). Copies pile up in chats, notebooks and phones. If nobody changes the password when someone leaves, that person keeps their way in (NDI). When one person holds every login, the organisation is stuck the day they’re ill, away or gone; that’s why more than one person needs admin access to each key account (SIIRF).

Better than sharing a password

A shared account is one login that several people use, such as the organisation’s email, a fundraising platform or the bank’s online portal. In order of preference:

1. Give each person their own access. Many services let several people use an account through their own logins, with only the rights each one needs (Security in a Box). Pages on social media have roles for this (Social media accounts). In Gmail, a delegate can read, send and delete mail for an account; their own address shows when they send, and they can’t change its password (Google). In Microsoft 365, a shared mailbox lets the colleagues you choose send from one address, and nobody needs its password (Microsoft).
2. Keep the rest in a shared vault. A shared vault is a part of a password manager that several people can open, each with their own main password, holding the logins they all need. In Bitwarden it’s a collection, with access set for each person or group (Bitwarden); a free Bitwarden organisation shares between two people only, so a team needs a paid plan (Bitwarden). With KeePassXC, the team keeps one shared file with its own passphrase, or shares a group of entries through its KeeShare feature (Access Now; KeePassXC). Password management helps you choose.
3. Never paste a password into a chat or an email. Share it through the password manager, or in person (Access Now; NDI). If someone needs a login for a day, give them a temporary password and change it again when they’re done (Security in a Box).

Backup codes and who holds them

A shared account still needs two-factor authentication. Set it up so the account never depends on one person’s phone:

• Two trusted people hold the backup codes for each shared account, each in their own password manager or printed and locked away, so no single person is the only way back in. Name them in your incident response plan.
• Add a second way in, such as a second person’s security key, where the service allows it (Security in a Box).
• Point the recovery email and phone number at the organisation, not at one person’s private number, and keep them current (SIIRF).

When someone leaves

Use a short checklist on the person’s last day, covering accounts, shared passwords, devices and group chats (SIIRF). Make someone responsible for it (NDI), and do it for everyone, every time, so it’s routine rather than a sign of distrust.

1. Take them out of everything shared. That means the shared vault, roles on your Pages, delegated mailboxes, admin roles and the work group chats (SIIRF).
2. Change every shared password they knew. Start with the bank and email (NDI). If they held backup codes for an account, make a new set and give it to whoever takes their place.
3. Hand over their own accounts. Ask them to set an out-of-office message saying who to contact now, and to forward their mail to a colleague. Keep their mailbox for a couple of months before you close it, and move their files to a colleague first (Access Now).
4. Collect what they hold. That’s laptops, phones, keys and door cards (Access Now).

Volunteers, temporary staff and partners who were given access count too: give them only what they need, for as long as they need it (SIIRF). Who has access covers joining and leaving for everything else.

Bringing your team with you

1. List every login more than one person uses. For each, note who knows it, where its recovery email and phone number point and who holds its backup codes (SIIRF). Keep the list in the password manager, not in a document anyone can open.
2. Start small. Try the shared vault with one or two colleagues and the logins that matter most, such as email, the bank and the fundraising platform, before you move the rest.
3. Move them one at a time. Give people their own access where you can, or put the login in the shared vault, and change the password as you move it, so the old copies in chats stop working.
4. Tell everyone where logins live now. Passwords no longer go in the chat. Help anyone who’s unsure one to one, and keep the team chat open for questions.
5. Write the leaver’s checklist down. Use it every time someone goes (Access Now). Add it to your security policies.
6. Check every three months. Make sure the list matches who still works with you. Checklists and audits has the rest of the quarterly check.

If it’s already happened

• Someone used a shared login who shouldn’t have: change the password, check what they did, and follow Account taken over if they changed any settings.
• The only person who knew a login has gone: use the service’s own recovery page with the recovery email or phone number the organisation controls; Account taken over lists the official pages. Then put the login in the shared vault.
• A password was posted in a chat: change it, and keep the new one in the vault.

Teach it to your team

A 20-minute session for your next team meeting.

• Prepare: set up the shared vault, and bring the list of shared logins: the names of the accounts only, never the passwords.
• Exercise: go through the list together and decide, for each login, whether people get their own access, it goes in the shared vault or the account is closed. Then move one login into the vault together and change its password.
• Three questions: Where do you find the fundraising platform’s login now? Who holds the backup codes for our email? What changes on the day someone leaves?
• Afterwards: as each password changes, delete the old copies from the chat. Help anyone who’s stuck one to one, and keep answering questions in the team chat.