Shared Accounts at Work: Risks and How to Manage Them

What is a shared account at work?

A shared account is a single set of login credentials that more than one person uses to sign in to the same service. The service sees one user; in reality, three or ten people are behind it.

Common examples at work:

The company Instagram, TikTok or X profile used by the marketing team.
A generic mailbox such as support@ or accounts@ that several people sign in to directly.
A supplier, bank-portal or government-portal login issued to the business, not to a person.
Domain registrar, hosting or ad accounts where the plan includes only one user.
Software where the team bought one seat and passes the login around to save money.

A shared account is different from shared access. Shared access means several people can reach the same resource, but each signs in as themselves (for example, a shared Google Drive folder). Shared logins mean they all sign in as the same identity.

What are the risks of shared logins?

The main risks of shared logins are that you lose track of who did what, and you cannot remove one person without changing the password for everyone.

No audit trail

When five people sign in as marketing@company.com, the service's activity log shows one name. If a post is deleted, an invoice is changed or a setting is switched off, you cannot tell who did it. That matters for mistakes as much as for misuse.

Leavers keep the password

A former employee or contractor who knew the password can still sign in until someone changes it. In many teams nobody owns that task, so the old password survives for months. Our employee offboarding password checklist covers this step in detail.

The password spreads

Shared passwords tend to travel through chat, email, spreadsheets and sticky notes. Every copy is another place it can leak, and none of those copies disappear when the person who received them leaves.

Two-factor authentication gets weaker or switched off

Two-factor codes usually go to one person's phone. When that person is busy, on holiday or gone, the team is locked out, so teams often turn 2FA off. That removes one of the strongest protections the account had.

Weak or reused passwords

Passwords that several people must type tend to be short and memorable, and they often get reused on other accounts. Guidance such as NIST SP 800-63B recommends long, unique passwords, which are hard to share by hand.

When is a shared account fine?

A shared account is fine when the service genuinely offers no way to give each person their own login, or when per-user seats are not worth the cost for a low-risk tool.

Use this table to decide:

Situation	Shared account?	Why
Service supports individual users or roles (Google Workspace, most CRMs, Slack)	No — give each person a seat	You get per-person logs and can remove one person cleanly
Social media brand profile without a business manager option	Yes, managed	Often the only way several people can post
Supplier or government portal issued to the company	Yes, managed	The provider issues one login per business
Admin or root account (domain registrar, cloud provider)	Only for break-glass use	Day-to-day work should use personal admin accounts
Low-cost tool where one seat is passed around	Check the vendor's terms	Some vendors do not allow seat sharing

If a service offers individual accounts, use them. The rest of this guide is for the accounts where sharing is the only realistic option.

How do you manage shared logins safely?

To manage shared logins safely, keep the password in one encrypted place, give access per person, and treat every departure as a reason to change the password.

List every shared account. Write down the service, what it is used for, who uses it, and who owns it. The owner decides who gets access and changes the password when needed.
Move the passwords into a team password manager. Delete copies from chat threads, email drafts and spreadsheets once they are stored.
Give a strong, unique password. Generate a long random password for each shared account. Nobody needs to remember it if the password manager fills it.
Grant access per person, not per group chat. Share each login only with the people who need it, at the lowest level that works for them.
Keep two-factor on. Record who holds the 2FA device or authenticator secret, and set up a way for others to get the code without turning 2FA off.
Store backup codes. Keep the service's recovery codes with the login so the team is not locked out if the 2FA holder is unavailable.
Change the password when someone leaves. Remove their access in the password manager first, then change the password on the site itself.
Review the list every quarter. Remove people who no longer need access and close accounts nobody uses.

How do you give shared access without revealing the password?

The safest way to give shared access is a password manager that fills the login for the person without showing them the password.

This suits contractors, virtual assistants and new hires who need to post, check an order or download a report, but should not be able to copy the password and take it with them. If they never see it, a departure carries less risk, although you should still change the password if they could have viewed it at any point.

Access levels worth looking for in any tool:

Owner — manages the login and who it is shared with.
Edit — can update the password and details.
View — can see and copy the password.
Fill-only — can sign in, but cannot see or copy the password.

More on this approach in login-only access for contractors.

How do you handle 2FA on a shared account?

Handle 2FA on a shared account by storing the authenticator secret where the team can use it, or by naming one code holder and giving others a quick way to ask them.

Authenticator app (TOTP) codes: the setup QR code can be stored in a team password manager, so each authorised person gets the 6-digit code when they sign in.
SMS or email codes: these go to one phone or inbox. Write down who holds it, keep a backup holder, and agree how codes are passed on.
Backup codes: save them with the login and mark each one as used.

Never solve the problem by turning 2FA off. Our guide to sharing 2FA codes with a team goes step by step.

What should you do when someone with shared access leaves?

When someone with shared access leaves, remove their access on the same day, then change the password of every shared account they could see.

Remove the person from the password manager and any shared folders.
Hand over anything they owned to a remaining teammate.
List every shared login they could view and change each password on the site.
Move any 2FA they held (phone number, authenticator) to another person.
Check each service for sessions still signed in and sign them out where the service allows it.

Logins they could only fill, never view, are lower risk, but rotating them is still the safer choice if in doubt.

How BobWork Vault manages shared accounts

BobWork Vault is a free, zero-knowledge password manager for teams that covers the steps above. Team sharing is included in the free plan.

Share a single password or a shared folder, with Owner, Edit, View or Login only access. Login only means the Chrome extension fills it and the teammate cannot see or copy it.
Store authenticator secrets and fill the 6-digit code after the password; record who holds SMS, email or app-prompt 2FA, and let a teammate ask the holder for the code, which is sent back encrypted and expires in 10 minutes.
Keep backup codes per login, with a low-codes warning.
Use the guided offboarding flow to remove a leaver, hand over what they owned and get a checklist of passwords to change on each site, plus an audit log of actions.

It runs as a Chrome extension (also Edge, Brave and Arc) and a web vault at vault.bobwork.ai that works in any modern browser. If your next step is to share passwords with teammates properly, you can create a free BobWork Vault account and import your existing logins from a CSV.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

More: free password manager · free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers

Questions

Is it safe to use a shared account at work?

Yes, if it is managed: the password is strong and unique, stored in a team password manager, shared per person, protected by 2FA, and changed when anyone with access leaves. Unmanaged shared logins passed around in chat are not safe.

What is the difference between a shared account and shared access?

A shared account is one login used by several people, so the service sees one user. Shared access means several people can reach the same resource while each signs in with their own account, which keeps a per-person audit trail.

Can I share logins without giving out the password?

Yes. Some team password managers can fill a login for a teammate without letting them see or copy the password, which suits contractors and virtual assistants. BobWork Vault calls this Login only access.

What happens to shared logins when an employee leaves?

They keep working for the former employee until the password is changed. Remove their access in your password manager, then change the password on every shared account they could view and move any 2FA they held.

How often should you change a shared account password?

Change it whenever someone with access leaves, or when you suspect it leaked. NIST SP 800-63B advises against forced periodic changes for no reason, so event-based changes are the standard approach.