How to share a password without revealing it to contractors, agencies and interns

Why not just send the contractor the password?

Agencies, freelancers and interns often need to sign in to your tools for a few weeks or months. Sending the password in an email or chat feels quick, but it creates problems that last much longer than the project.

• The password sits in their inbox, chat history and possibly their personal password manager.
• You cannot tell whether it has been reused or passed on to someone else at their firm.
• When the contract ends, removing access means changing the password for everyone who uses it.
• If they handle several clients, a breach on their side can expose yours.

The goal is access that you can grant quickly, limit sensibly and remove completely.

What is the best way to give a contractor access?

Work down this list and stop at the first option the app supports.

1. A separate user account with a limited role. Most business tools, including ad platforms, analytics, CMS and design tools, let you invite a guest or collaborator. They use their own password and 2FA, and you remove them with one click.
2. Single sign-on with their own identity, where the app and your plan support it. Access follows your identity provider, so disabling them there removes it everywhere.
3. Partner or agency access, where the platform has it. Some platforms let an agency's business account manage your assets without any shared login.
4. A shared login with login-only access through a password manager, for apps that only allow a single account.
5. A shared login with full view access, only for trusted people who genuinely need to see the password.

How does login-only (fill without view) access work?

Several team password managers offer a permission that lets the browser extension fill a password into the login form without displaying it to the user. Names vary: "login only", "use only", "fill only" or "logon". The idea is the same.

The contractor sees the saved entry in their extension, clicks it on the login page, and the password field is filled. They cannot open the entry to read the password, and the copy button is not available to them. They get on with the work; you keep control of the secret.

What are the honest limits of login-only access?

Login-only access is a strong deterrent, not a guarantee. Once a password is filled into a web page, it exists in that page as text so the site can submit it. A technically skilled, determined user could use the browser's developer tools or a script running in the page to read the filled value.

That does not make the feature useless. It removes casual exposure: no password in chats, no copy-paste into personal notes, no shoulder-surfing, no easy reuse. It also signals clearly that the password is not theirs to keep. But plan as if someone could have extracted it:

• Rotate the password when the contractor leaves, every time.
• Use login-only together with 2FA stored in the same entry, so the password alone is less useful.
• Prefer separate accounts for anything high-risk, such as payments, admin consoles or production systems.
• Review who has access at the end of each project.

How does Login only work in BobWork Vault?

BobWork Vault is a free team password manager with four access levels for each shared password or shared folder: Owner, Edit, View and Login only. With Login only, the Chrome extension fills the login and the teammate cannot see or copy the password.

1. Invite the contractor by email from Settings › Team › Invite teammate.
2. Put their logins in a shared folder for the project, or share individual items.
3. Choose Login only as their access level.
4. If the site uses an authenticator, store the TOTP secret in the same entry; the extension fills or copies the 6-digit code after the password.
5. When the engagement ends, run the guided offboarding flow. It removes their access, re-keys the remaining shared items and builds a checklist of passwords to change on each site.

The same honest limit applies: Login only stops casual viewing and copying, so pair it with rotation at offboarding. The audit log records actions on the vault, which helps with reviews.

Which access level should each type of person get?

What should a contractor access checklist include?

Use this before, during and after every engagement, whatever tool you use.

• Before: list every system they need. For each, decide between a separate account and a shared login.
• Before: give each shared login the lowest access level that works, and add 2FA.
• Before: agree in the contract that credentials stay in your password manager and are not copied elsewhere.
• During: add new logins to the shared folder rather than sending them in chat.
• After: remove their access on the same day the contract ends.
• After: change every shared password they could use, and reset 2FA secrets they could have seen.
• After: remove their separate user accounts and any API keys or tokens issued to them.

Who should own the accounts an agency creates for you?

Agencies often set up new tools on your behalf: a scheduling app, a landing page builder, a new ad account. If those accounts are registered to the agency's email address, you may not be able to recover them when the relationship ends.

• Ask for every new account to be registered to an address your business controls.
• Have the agency save each new login straight into your shared folder, so you hold the record from day one.
• Make sure your business, not the agency, is the owner or primary admin wherever the tool has roles.
• Keep 2FA secrets for those accounts in your vault, not on an agency employee's phone.

This turns the end of a contract into a routine handover instead of a recovery project.

What other mistakes should you avoid?

A few habits undo good access control. Avoid letting contractors save your passwords in their own browser or personal password manager; turn off browser password saving on shared machines. Do not create one shared "contractor" login that several freelancers use, because you lose any record of who did what. And do not leave access open "in case they need it again"; re-inviting someone takes a minute.

For the cryptography behind sharing, read zero-knowledge encryption explained. For shared authenticator codes, see how to share 2FA codes with a team. When you are ready, create a free team vault and set up your first contractor folder.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• What is zero-knowledge encryption in a password manager?
• How to set up a shared Google account for a team without passing one phone around
• How to share passwords with your team
• Team password managers compared

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers