Employee Offboarding Checklist: Passwords & Access

Why do passwords need their own offboarding checklist?

Most offboarding checklists cover laptops, payroll and building access. Passwords fall through the gaps because nobody has a full list of what a person knew.

A departing employee usually has two kinds of access. Their own accounts, such as company email and named app logins, are easy to disable centrally. Shared credentials, such as the social media login, the supplier portal or the Wi-Fi password, are harder, because disabling them would lock out everyone else.

Shared credentials are where most of the risk sits. Even if a leaver parts on good terms, their personal devices, browser saves and chat history may still hold those passwords for years.

What should you do before the last day?

A little preparation makes day 0 calm instead of rushed.

Build an access inventory. List the person's own accounts and every shared login they can use. A password manager's sharing view makes this quick; chat history and spreadsheets do not.
Name a successor for each item. Decide who will own each account, folder and 2FA device after the handover.
Find the 2FA dependencies. Check which accounts send codes to the leaver's phone or authenticator app. These need re-enrolling.
Agree the timing. Decide with HR and the manager exactly when access ends, and who performs each step.

What is on the day-0 employee offboarding checklist?

Do these on the last working day, ideally at the moment access should end.

Disable or suspend the person's company email and identity account.
Sign them out of active sessions in email and key business apps, where the app allows it.
Remove them from the team password manager and from every shared folder.
Transfer ownership of items, folders and documents they owned to the named successor.
Remove them from admin roles in cloud, finance, domain and social media accounts.
Revoke personal API keys, access tokens and SSH keys they created.
Remove their devices from any list of trusted or managed devices.
Collect company hardware and confirm it is wiped or reassigned.
Change the passwords for the highest-risk shared accounts immediately: banking, payroll, domain registrar, main email admin, and anything they had Owner or Edit rights on.

What is on the week-1 offboarding checklist?

Within the first week, work through the rest of the shared credentials and tidy up.

Change every remaining shared password the person could view or copy.
Re-enrol two-factor authentication on accounts where the leaver's phone held the authenticator or received SMS codes.
Update recovery email addresses and phone numbers that point at the leaver.
Check forwarding rules and delegated mailbox access set up by or for the person.
Review the password manager's audit log for anything unusual in the days before departure.
Confirm the successor can sign in to every handed-over account.
Record what was revoked, rotated and transferred, with dates, and store it with the HR record.

Which accounts should be rotated first?

Not every password carries the same risk. Use a simple priority table so day 0 focuses on what matters.

Priority	Examples	When to rotate
Critical	Banking, payroll, domain registrar, DNS, email admin, cloud hosting root accounts	Day 0
High	Social media accounts, payment processors, customer databases, CRM admin	Day 0 or day 1
Medium	Supplier portals, marketing tools, analytics, shared inboxes	Within week 1
Low	Read-only dashboards, trial accounts, internal tools behind company sign-in	Within week 1, or close the account

If the person had Login only access in a password manager, meaning they could use the login but never saw the password, the urgency for those items is lower. They still had working sessions, so sign them out where possible.

How do you hand over two-factor authentication?

Two-factor authentication is often the step that locks a team out after someone leaves. The fix is to stop tying shared accounts to one person's phone.

Store the authenticator (TOTP) secret for shared accounts in the team password manager, so codes are available to whoever has access.
When re-enrolling, generate a new secret. The old one may still be on the leaver's device.
Replace SMS codes sent to a personal number with an authenticator where the service supports it.
Download fresh recovery codes and store them in a restricted vault folder.

How is offboarding a contractor or agency different?

Contractors and agencies often have narrower access but less oversight. They may use their own devices, their own email and their own password tools, so you cannot disable a company account to cut them off.

Grant access with an end date in mind. Note in your inventory when each contractor's work is expected to finish.
Prefer fill-only access. If your password manager supports it, let contractors use logins without viewing or copying the password.
Give them their own user where possible. Many services let you add a named collaborator instead of sharing the main login, which you can remove without rotating anything.
Run the same checklist on the last day of the engagement. Remove them, rotate anything they could see, and record it.

Agencies change staff too. Ask them to tell you when someone who worked on your accounts leaves, and treat that as an offboarding event.

What goes wrong most often?

No inventory. Without a list of shared logins, people rotate the ones they remember and miss the rest.
Rotating but not storing. A new password set in a hurry and never saved creates a lockout a month later.
Forgetting browser saves. Passwords saved in a personal browser profile leave with the person. Only rotation fixes that.
Leaving the leaver as owner. Shared items or folders still owned by a removed account can become hard to manage.
No record. If an incident happens later, you need to show what was done and when.

How can a password manager make offboarding faster?

The checklist above works with any tool, but it is far easier when shared passwords already live in one place with per-person access. You can see exactly what someone could reach, remove them once, and know which items to change.

BobWork Vault, a free team password manager, includes a guided offboarding flow. It removes the leaver's access, hands over what they owned to another teammate, re-keys the remaining shared items, and builds a checklist of passwords to change on each site. The audit log records the actions. The vault can also store authenticator secrets and fill the 6-digit code after the password, which removes the one-phone 2FA problem.

BobWork Vault does not remind you to rotate passwords on a schedule and does not connect to SSO or SCIM, so pair it with your identity provider's own offboarding for company accounts. Learn more about team sharing and the security model, or start a free team vault before your next departure.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers

Questions

When should you change shared passwords after an employee leaves?

Change the highest-risk ones, such as banking, domain and email admin, on the last day. Change all other shared passwords the person could see within the first week.

Do you need to rotate passwords the employee never saw?

If they could only use a login through a fill-only access level and never viewed or copied it, the risk is lower. Still sign them out of active sessions and prioritise items they could view or edit.

Who should own offboarding for passwords?

Name one person, often an IT lead or operations manager, who runs the checklist with the leaver's manager. HR triggers it, but someone with admin access must do the steps.

What if the leaver's phone has the 2FA codes for a shared account?

Sign in with recovery codes or another admin, re-enrol two-factor authentication with a new secret, and store that secret in the team password manager so it is not tied to one phone.

Does BobWork Vault help with offboarding?

Yes. Its guided flow removes the person's access, transfers what they owned, re-keys remaining shared items and builds a checklist of passwords to change, with actions recorded in the audit log.