How Agencies Share Client Passwords Securely (Without Chaos When Projects End)

Why is password sharing harder for agencies than for normal companies?

An in-house team guards one set of accounts. An agency holds the keys to dozens of other companies: their ad accounts, social pages, hosting, CMS logins, domain registrars and email platforms. Each client is a separate trust relationship.

On top of that, the people change constantly. Freelancers join for a campaign, account managers move between clients, and a project ends but the logins keep working long after. The usual shortcuts, such as a shared spreadsheet, a pinned chat message or one login emailed around, make all three problems worse.

The goal is simple to state: each person can reach only the clients they work on, only at the level they need, and you can take that access away in minutes. The rest of this guide shows how to get there with any tool, and where BobWork Vault fits.

How should you organise client passwords?

Use one folder per client, and nothing else. Do not group by platform (“All Facebook logins”) or by person. Access is decided per client, so the folder structure should match.

• One folder per client. Name it exactly as the client is known internally.
• One entry per account. “Acme - Meta Business” and “Acme - Google Ads” are separate entries, not one note with several passwords.
• Store the 2FA secret with the login where your tool supports it, so nobody has to ask the client for a code on every sign-in. See how to share 2FA codes with a team.
• Keep agency-owned tools separate. Your own project tracker, invoicing and design subscriptions belong in an internal folder, not inside any client folder.

Never put client credentials in a chat thread, even a private one. Chat history is searchable, copied to other devices and rarely cleaned up. The reasons are covered in why you should not share passwords over WhatsApp, and the same logic applies to Slack, Teams and email.

What access should employees and freelancers get?

Apply least privilege: give the lowest level that still lets the person do the work. NIST and OWASP both recommend this as a baseline, and for agencies it also protects you contractually, because you can show a client exactly who could reach their accounts.

A sensible mapping looks like this:

Most freelancers do not need to read a password. They need to be signed in. A “login only” level, where the browser extension fills the credentials but the person cannot see or copy them, is the right fit. The reasoning is explained in login-only access for contractors.

One honest caveat: any password a person can use to sign in can, in principle, be captured by someone determined, for example by working inside the logged-in session. Login-only access reduces casual copying and accidental leaks. It does not replace rotating the password when the work ends.

How do you set this up in BobWork Vault?

BobWork Vault is a free password manager for teams, and team sharing is included in the free plan. The setup for an agency takes a short sitting:

1. Create one shared folder per client.
2. Invite teammates by email under Settings › Team › Invite teammate, and pick what each person gets: Owner, Edit, View or Login only.
3. Share the client folder with the people on that account, rather than sharing individual passwords one at a time. You can still share a single password when only one person needs it.
4. Save each client login as an entry in the folder. The extension offers to save new logins after you sign in, and stores authenticator secrets so it can fill the 6-digit code after the password.

Everything is encrypted in the browser before it is stored, and the server holds ciphertext only. The details are in zero-knowledge encryption explained and on the security page. If you are moving from another tool first, the import page covers CSV exports.

How do you offboard a contractor or employee from client accounts?

Offboarding is where most agencies leak access. The person's chat account gets closed, but the client's ad account still has their saved password in a browser. Treat it as a fixed checklist, run the same day the person stops working:

1. Remove them from every shared folder in your password manager.
2. Reassign anything they owned so no entry is orphaned.
3. List every account they could sign in to. Their folder membership tells you which clients and which sites.
4. Change those passwords on each site, not just in the manager. Updating the vault entry does nothing if the site still accepts the old one.
5. Remove them as a user on platforms that have their own user lists, such as ad managers, analytics and social pages, and revoke any active sessions.
6. Check recovery details. Make sure the person's email or phone is not the recovery contact for any client account.

BobWork Vault has a guided offboarding flow for this: it removes the leaver's access, hands over what they owned, re-keys the remaining shared items, and builds a checklist of passwords to change on each site. The audit log records the actions afterwards. For a longer version that covers email, devices and SaaS seats, use the employee offboarding password checklist.

What should you rotate when a client project ends?

A finished project is a quieter risk than a departure, because nobody feels responsible for it. Passwords from a campaign you ran two years ago may still be in a former freelancer's browser, in an old export file or in a screenshot.

Decide at kickoff which of two endings applies, and write it into the engagement notes:

• Handover. The client keeps the accounts. Transfer ownership of each account to the client, remove your agency's users, change every password and delete the client's folder from your vault once they confirm.
• Continuing retainer, new team. You keep working, but someone has left. Rotate every credential that person could use, as in the offboarding list above.

In both cases, prioritise in this order: the accounts that can spend money (ad platforms, payment processors), then those that can publish publicly (social, CMS, email platforms), then hosting and domains, then everything else. Also rotate any shared mailbox or API key that was used across several accounts.

Add a calendar reminder for the contract end date. BobWork Vault does not send password-expiry reminders, so the trigger has to live in your project process, not in the tool.

How should clients hand over their logins to you in the first place?

The handover direction matters too. Clients often paste credentials into an email or a form because nobody gave them a better way.

• Prefer delegated access over shared passwords. Business Manager, Google Ads manager access, social page roles and CMS user accounts let you sign in as yourself. That is better than holding the client's own password, and the client can revoke it in one click.
• Where a shared login is unavoidable (some registrars, legacy tools), ask the client to change the password to a new one after the handover and to tell you only once, through a channel they control.
• Move it straight into the client's folder and ask the sender to delete the original message.
• Never accept a spreadsheet of logins. Import it into the vault and delete the file, including from downloads and trash.

What are the common mistakes to avoid?

• One shared agency login for a client account. You cannot tell who did what, and you cannot remove one person without changing it for everyone.
• Freelancers using personal password managers or browser saving for client logins. When they leave, the credentials leave with them. For the browser-saving problem, see is Chrome's password manager safe for business.
• No owner for each client folder. Folders drift and access piles up. Name one person per client who reviews membership.
• Skipping 2FA on client accounts because it is inconvenient to share. Keep it on, and store the authenticator secret next to the login.
• Never reviewing who has access. Once a quarter, open each client folder and confirm every member still works on that client.

If you are choosing a tool for the whole agency, the best free password manager for teams guide compares what to look for, and the team sharing page shows how sharing works in BobWork Vault.

What is a simple agency password policy you can adopt today?

Write it on one page and put it in your onboarding for every employee and freelancer:

1. Client credentials live only in the team password manager.
2. One folder per client; access is granted per folder and at the lowest level needed.
3. Freelancers get login-only access where possible, and only for the engagement period.
4. Every client account has two-factor authentication on.
5. On any departure or project end, access is removed the same day and affected passwords are rotated within the week.
6. Folder membership is reviewed every quarter by the client's owner.

A fuller template is in the password policy template for small business. Note that BobWork Vault does not enforce a policy for you, so a written one is what makes it stick.

If you want to try this setup, create a free BobWork Vault account, make your first client folder and invite one teammate. The Chrome extension also works in Edge, Brave and Arc.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How to share a password without revealing it to contractors, agencies and interns
• Employee offboarding checklist: what to revoke, rotate and hand over
• How to share an Instagram account (and Facebook or TikTok) with your team without losing it
• Sample password policy for small business: a short, modern template you can copy today

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers