How to share an Instagram account (and Facebook or TikTok) with your team without losing it

Why are shared social media logins such a problem?

A brand's Instagram, Facebook page or TikTok account is often a single login that several people need: a social manager, a designer, a freelancer, the founder. The usual shortcut is to paste the password into a chat and hope for the best.

That shortcut hides three separate problems. The password gets copied into places you cannot clean up. The two-factor code goes to one person's phone, so everyone else has to ask that person every time they sign in. And the recovery email and phone number quietly belong to whoever created the account years ago.

The sections below deal with each in turn, starting with the best fix: not sharing the login at all.

How do you share an Instagram account without sharing the password?

Often, yes. Meta (Instagram and Facebook) and TikTok both offer business tools where individual people are added to a page or account with their own sign-in and a role. Features, names and limits change, so check each platform's current help pages for your account type.

• Facebook pages: add people to the page with a role or specific permissions, using their own Facebook accounts or a business tool.
• Instagram: business accounts can usually be connected to a Facebook page and managed through Meta's business tools, so teammates do not need the Instagram password.
• TikTok: business accounts can usually be linked to a business center where members are invited with their own accounts.

This is the cleanest setup. Each action is tied to a person, and removing someone is a role change rather than a password reset. Use it wherever it covers what your team needs.

When do you still need a shared login?

Shared logins remain common because platforms do not all expose every feature through roles, and small teams often start with one account that was created with a personal email. Typical cases:

• The account was set up before any business tool existed and migrating it is not a priority.
• A feature you need only works when signed in as the account itself.
• A freelancer or agency needs to post for a short time and you do not want to restructure the account.

If that is you, treat the login like a company asset: one stored copy, a known list of who can use it, and a plan for changing it when someone leaves.

What is the problem with two-factor codes on one phone?

Two-factor authentication (2FA) is worth keeping on for a social account, because a hijacked brand page is expensive to recover. NIST SP 800-63B and CISA both recommend multi-factor authentication for accounts that matter.

The trouble starts when the code is tied to a single phone. If the second factor is an SMS, it goes to one number. If it is an authenticator app, the secret lives on one device. Either way, the account is blocked whenever that person is on holiday, off sick, or gone.

The fix is to separate the code from the person. Authenticator apps work by a shared secret that generates a new six-digit code every 30 seconds. That secret does not have to live on one phone. It can live in a shared, encrypted place that the right teammates can use.

How do you share a TOTP code in a shared vault entry?

A password manager can hold the authenticator (TOTP) secret next to the password in the same entry. The manager then generates the six-digit code, so nobody has to find the one phone.

1. When you turn on 2FA for the account, choose the authenticator app option.
2. The platform shows a QR code and often a text setup key. Copy the setup key, or scan the QR code with the password manager.
3. Save it in the same entry as the username and password, and confirm that the generated code is accepted by the platform.
4. Download or print the backup codes the platform gives you and store them in the entry or a secure note.
5. Share that entry only with the people who need it.

BobWork Vault stores authenticator (TOTP) secrets and fills or copies the 6-digit code after the password. For a full walk-through of the idea, see how to share 2FA codes with your team.

One honest caveat: putting the password and the second factor in one place means anyone who can open that entry has both. That is the trade-off for convenience, which is why the access level you grant matters.

Which access level should freelancers get?

A freelancer or agency usually needs to sign in and post, not to read the password or take it with them. In BobWork Vault, Login only means the extension fills the login for them and they cannot see or copy it. Other access levels are Owner, Edit and View.

A sensible split for a small team:

• Owner: the founder or an admin, never a freelancer.
• Edit: a trusted employee who may need to update the entry when the password changes.
• View: use sparingly, because viewing means the password can be read.
• Login only: freelancers, agencies and short-term helpers.

When the engagement ends, remove their access and change the password. Login only limits what they could copy, but it does not replace changing the password when someone leaves. More detail in login-only access for contractors.

Who should own the recovery email and phone number?

This is the question most teams skip, and it is the one that decides whether you can get your account back. Every major platform lets you reset a password through the recovery email or phone number on file. Whoever controls those controls the account.

Run through this checklist for each social account:

• Login email: a company-owned address such as a shared mailbox or group, not a personal inbox.
• Recovery email: also company-owned, and a different address from the login email.
• Recovery phone: a company-controlled number if possible. If a personal number is the only option, write down whose it is and replace it when they leave.
• Account ownership on the platform: make sure at least two trusted people with company roles are admins of the business page or business center.
• Backup codes: stored in the shared entry, not in someone's notes app.

Write down where each of these is recorded. If the only record is in one person's head, you have not fixed it.

What if the account is tied to an employee's personal email?

This is very common: the founder or an early hire created the page with their personal address and phone. You do not need to rebuild the account, but you should move the recovery details while that person is still around and cooperative.

1. Add a company-owned email as the login or a secondary email on the account.
2. Replace the recovery phone with a company number, or add one.
3. Add a second admin through the platform's business tools.
4. Change the password and re-enable 2FA with the secret saved in the shared entry.
5. Remove the personal details once you have confirmed everything still works.

Do this before an offboarding, not during one. Our employee offboarding password checklist covers what to change when someone leaves.

How do you do this in BobWork Vault?

BobWork Vault is a free password manager for teams, and free includes team sharing. You can save the social login, add the authenticator secret to the same entry, and share it per password or in a shared folder, such as one folder for all brand accounts.

Invite teammates by email from Settings › Team › Invite teammate and pick what each person gets. The Chrome extension (also Edge, Brave and Arc) shows a key icon in login fields for one-click fill, and the web vault at vault.bobwork.ai works in any modern browser, including Safari and Firefox. There are no mobile apps, so plan for phone-only posting accordingly.

Everything is encrypted in the browser, and the server stores ciphertext only. See how the security works, or read how team sharing works.

What should you do when someone leaves the team?

Treat a departure as a recovery drill. Remove the person from every platform role first, then change the shared passwords, then reset the 2FA secret if they ever had access to it.

BobWork Vault has a guided offboarding flow that removes a leaver's access, hands over what they owned, re-keys remaining shared items and builds a checklist of passwords to change on each site. You still have to change them on the sites themselves, which is where the checklist helps.

Finally, check the platform's logged-in devices or sessions list and sign out anything you do not recognise.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• How to share 2FA codes with your team without waiting for one person's phone
• How to share a password without revealing it to contractors, agencies and interns
• Employee offboarding checklist: what to revoke, rotate and hand over
• How to set up a shared Google account for a team without passing one phone around

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers