Access control

How to share passwords securely at work: a UK small business guide

Most small firms share some logins: the bank, HMRC, the website, social media, a supplier portal. That is normal. The risk is how they get shared. This guide shows a safer way that takes an afternoon to set up.

Last updated:

Why is sending passwords by message a problem?

A password sent by WhatsApp, Teams, text or email does not go away. It sits in the chat history on every phone and laptop that is signed in. It is often copied into backups too.

That causes three problems:

  • It spreads. You cannot tell who has seen it, screenshotted it or forwarded it.
  • It outlives the job. Someone who leaves still has the password in their phone.
  • It helps attackers. If one email or chat account is broken into, searching for "password" is often the first thing an attacker does. Our shared email account guide explains why that matters. If your business email has already been taken over, see what to do when a business email is hacked.

Spreadsheets and notebooks have the same issue. They get copied, and nobody knows who opened them.

Can each person have their own login instead?

The safest shared password is one you do not need. Before you share a login, check whether the service lets you add people as separate users. Many do:

  • Shared email: a Microsoft 365 shared mailbox lets staff open info@ or accounts@ with their own login, so there is no shared password to pass round.
  • HMRC: an administrator can add team members to your HMRC business tax account and choose which taxes each one can access.
  • Business banking: many business bank accounts let you add users with their own login and payment limits. Ask your bank.
  • Social media and website tools: most let you invite people as admins or editors, so you can remove them later without changing anything for everyone else.

Separate logins tell you who did what. They also let you remove one person without disrupting the rest of the team.

How do you share passwords securely, step by step?

For the logins that really must be shared, use a business password manager. The NCSC recommends password managers as a way to create and store strong, unique passwords.

1. Set up a company account

Sign up with a company email address, not a personal one. Add a second admin so you are not locked out if one person is away.

2. Protect it with MFA

Turn on two-step verification for everyone's password manager login. This is the one account where it matters most. Our authenticator app guide shows how to set it up for staff.

3. Create folders by role, not by person

Group shared logins into folders such as Finance, Marketing and Operations. Give each person access to the folders they need for their job, and nothing else.

4. Move the most important logins first

Start with the bank, HMRC, payroll, the website and domain, and the main supplier portals. Change each password as you move it, using a long random one generated by the password manager.

5. Delete the old copies

Once a login is in the password manager, delete it from chats, emails, spreadsheets and sticky notes. Agree one simple rule: passwords never go in a message.

6. Review access every few months

Check who has access to each folder. Remove anyone who no longer needs it. Most business password managers show who can see what.

Our guide on how to stop staff reusing passwords has tips for getting the team on board without nagging.

What if you cannot set up a password manager today?

Sometimes you need to share one login right now. A few habits reduce the risk until you can do it properly:

  • Tell the person the password in person or on a phone call, rather than writing it down.
  • If you must write it, send the username and the password by different routes, and delete the message afterwards.
  • Change the password once the job is done if the person only needed it briefly.
  • Never add passwords to a shared spreadsheet or a group chat.

These are stopgaps. They do not tell you who has access, which is the main reason to use a password manager.

What about accounts that send a code to one phone?

Shared accounts with MFA can be awkward when the code goes to one person's phone. If that person is off sick, nobody can get in.

The best fix is separate users, as above. Where a service only allows one login, several password managers can store the authenticator code alongside the password. Everyone with access to that folder can then sign in, and you can remove that access in one place.

What should you do when someone leaves?

On their last day, remove them from the password manager and from any service where they had their own login. Then change the shared passwords they could see, starting with money and email.

With a password manager, you can see exactly which logins that person had, so nothing gets missed. Our staff leaver checklist covers email, devices and other accounts.

Which password manager should a small business use?

Most well-known business password managers include shared folders, an admin console and a way to remove users. Our guide to choosing a password manager for a small business compares the main options for UK firms. For a closer look at three popular tools, see NordPass vs 1Password vs Bitwarden.

NordPass is one option for small teams. Its business plans include an admin panel and ways to share logins with colleagues. Check which plan includes shared folders before you buy.

A password manager also helps with the user access control part of Cyber Essentials, which is about knowing who can get into what. It does not give you the certificate on its own.

FAQ

Is it safe to send a password by WhatsApp or email?
It is better than shouting it across the office, but it is not a good habit. The password stays in the chat or inbox, on every device that is signed in, and often in backups. Anyone who gets into that account later can find it. Use a password manager to share it instead.
Is it OK to keep company passwords in a spreadsheet?
We would not recommend it. A spreadsheet is easy to copy, forward or leave on a laptop, and you cannot tell who opened it. A business password manager encrypts the logins, shows who has access and lets you remove access in one place.
Is it against the law to share passwords at work in the UK?
Sharing a password is not illegal in itself. But if the account holds personal data, UK GDPR expects you to keep it secure, and the ICO's guidance covers access controls. Some services' terms also say each person should have their own login. Check the terms for the services you use.
Should we change shared passwords when someone leaves?
Yes. Change any shared password the person could see, starting with the bank, email admin, payroll and HMRC. A password manager makes this quicker because you can see exactly which logins they had.
How do we share an account that sends a code to one person's phone?
Where the service allows it, add each person as their own user. If it does not, several password managers can store the authenticator code with the login, so the team does not depend on one person's phone.

Official guidance

Sources we checked

Pages were checked on 23 October 2026.

Written for UK SME owners. More guides · How we make money