Sharing credentials with people you trust might seem harmless, but it can introduce security risks and vulnerabilities. Let’s take a closer look at mistakes to avoid, along with best practices for secure password sharing.
Passwords for streaming services, retail accounts, WiFi networks, and workplace digital tools (like the company Twitter account) are commonly shared with friends, family members, or coworkers. Password sharing is almost unavoidable for many of these accounts because establishing individual accounts and passwords for each user can be impractical or unaffordable.
However, just because it’s common practice doesn’t mean it’s safe. To minimize your risk, you need to learn how to share passwords securely.
What to do when sharing passwords
Before you can securely share passwords, you need to shore up your own password hygiene. That means establishing and maintaining good cybersecurity habits to avoid hacking, data breaches, and password theft—all things that can be accelerated by password sharing. Strong password practices include:
- Creating strong passwords: A strong password includes at least 12 characters and a random mix of uppercase letters, lowercase letters, numbers, and special characters. A secure password leaves out sequential strings like 12345 and phrases like names or addresses that can be linked to your identity. If you share weak passwords, you’re exposing everyone you’ve shared the password with to hacking tactics like brute-force attacks and dictionary attacks that prey on weak and commonly used passwords.
- Creating a unique password for each account: With so many accounts and passwords to manage, reusing passwords is an easy habit to fall into. Like password sharing, password reuse magnifies your vulnerability. If a repeated password is ever lost or stolen, the same credentials can be used to breach multiple accounts. Dashlane’s Password Health tool helps you eliminate password reuse by providing up-to-date lists of your weak, compromised, and reused passwords.
- Following your workplace password policy: Establishing password sharing rules for the workplace is one of the most important functions of a company password policy. These policies help to build a culture of security to reinforce positive password habits. They can also be used to educate employees on the dangers of password sharing when employees (or ex-employees) share passwords insecurely without notifying the IT team.
- Setting up 2-factor authentication: 2-factor authentication (2FA) uses a second credential, like a push notification sent through an app or text, to confirm user identity. This might add a few seconds to your login time, but it also makes it nearly impossible for an intruder to access your accounts without having your device in their possession.
- Changing passwords after a data breach: Some companies continue to impose outdated edicts like 30/60/90-day intervals for password resets. Requirements for frequent password changes can actually lead to less secure passwords when people make simple changes, such as adding a number or symbol at the end. However, you should always change your password immediately if you think or know it’s been impacted by a data breach, and tell anyone you’ve shared with to do the same.
- Using a password manager: As you learn how to securely share passwords, a password manager makes it easier to create and autofill strong passwords automatically and store them in an encrypted vault. Features like 2FA, a Password Health score, and a secure, encrypted password-sharing portal can help you improve your password hygiene to minimize the risks associated with password sharing.
What not to do when sharing passwords
Password sharing risks can be reduced by avoiding a few common mistakes and unsafe practices. To carry out secure password sharing, make sure you don’t:
- Write them down in plain sight: Remote working and increasingly long password lists have contributed to careless password management habits like writing them down in a notebook or on sticky notes. This allows old-fashioned password theft strategies like shoulder surfing to remain effective in the digital age.
- Share through email: Is email a secure way to share passwords? No, the wealth of confidential information shared over email makes these accounts a prime target for hackers and scammers who use methods like phishing attacks to steal passwords. If you share a password over email, the unencrypted credentials will be easily discoverable in the case of a breach.
- Share through text message: Many thousands of text messages are sent each second globally, but they’re not the best way to share passwords. Much like email messages, text messages are stored indefinitely in an unencrypted format, and many people save texts that include passwords for future reference. Sharing passwords through text also leaves them exposed if your cell phone is lost or stolen.
- Share using Slack: Businesses of all types are using online communication platforms like Slack to collaborate and share information in real time. Some people may think these forums are also safe for password sharing, but that isn’t the case. Sharing passwords through Slack is risky since, like text messages, the unencrypted messages are stored indefinitely. In addition, large user groups might have access to Slack channels, which increases the risk of passwords falling into the wrong hands.
- Send over an unsecured WiFi network: Public WiFi networks in places like airports, cafés, and hotels are susceptible to data intercept tactics like WiFi network spoofing. Be careful with what information you share using public WiFI, and use a VPN whenever possible. A VPN reduces the risk of data intercepts by encrypting all data going into or out of your device and routing it through a secure portal.
- Save in an unencrypted shared file: Organizations like JFK International Air Terminal have learned firsthand that password-sharing portals are not secure unless they include encryption and adequate access controls. Open access password vaults allow users to change stored passwords that may be used by others or copy and paste them into unprotected browser password managers.
- Lose track of who has what password: Uncontrolled password sharing can make it difficult to remember who you’ve shared passwords with and whether their information is up to date. This can create a minor inconvenience for friends and family members when streaming or WiFi passwords are changed but poses a more serious security risk for businesses when employees leave the organization in possession of active company account credentials.
Solving the offboarding mistake at the organizational level
Among the password sharing mistakes covered above, the one with the highest severity for a business is also the hardest to fully prevent through individual employee discipline alone: Former employees retaining access to shared credentials after they leave.
No amount of employee training solves this completely because the problem isn't employee behavior at the point of sharing. It's the absence of a mechanism to revoke that access later, at the moment it needs to be revoked.
Why this mistake persists even in security-conscious organizations
When credentials are shared informally, over email, in a shared document, or even through basic password manager sharing without centralized administration, there's often no complete record of who currently has access to what.
An employee who received a shared credential eight months ago for a project that has since ended may still have functioning access long after anyone remembers they were given it. Multiply this across a growing team and a departing employee's actual credential footprint becomes difficult to reconstruct at the exact moment it matters most: the day they leave.
The admin-level fix: centralized sharing with instant revocation
A business password manager with centralized administration addresses this structurally rather than relying on institutional memory:
- Every shared credential shows who currently has access and at what permission level, right from the item itself. Admins get a timestamped Activity Log of sharing events, filterable by credential and exportable or streamed to your SIEM, for audit and compliance.
- Offboarding revokes access in one action, not several. When an employee is removed from the organization, an admin can revoke their access to every shared credential at once, rather than needing to identify and individually rotate each one.
- SCIM-based deprovisioning automates the trigger. For organizations with SCIM integration between their identity provider and password manager, removing an employee from the identity provider automatically revokes their password manager access, including all shared credentials, closing the gap between “the employee left” and “their access was actually removed.”
- The credential itself doesn't need to change. Unlike the informal sharing methods described in this article, revoking one person's access to a centrally shared credential doesn't require changing the password for everyone else who still needs it. The team continues working without disruption while the departing employee's access is cleanly removed.
For a security team responsible for offboarding across a growing organization, this is the difference between a repeatable, low-effort process and a manual audit that gets skipped when the team is busy, which is exactly when it matters most.
How does a password manager make password sharing more secure?
A password manager makes password sharing more secure by generating strong, random passwords and providing secure vaults for password storage and sharing, so your data is safely encrypted and protected. Additional features, including 2FA, a VPN, and a Password Health score, protect you from external attacks while improving password hygiene and productivity.
Dashlane also includes Dark Web Monitoring to scan the depths of the internet for your credentials and alert you if they’re detected. Dashlane’s encrypted sharing portal utilizes patented zero-knowledge architecture to ensure no one (including Dashlane) has access to your unencrypted passwords and private messages. You can share passwords with other Dashlane users through the secure, encrypted portal and avoid unsafe password sharing habits.
For IT and security teams, Dashlane's admin console maintains a live, centralized record of shared credential access and lets IT revoke a departing employee's access in one action, closing the gap this article's offboarding mistake describes.
Frequently asked questions
What happens to shared passwords when an employee leaves the company?
Without centralized administration, shared credentials often remain accessible to former employees because there is no complete, current record of who has access to what. A business password manager with an admin console solves this by maintaining a live record of shared credential access and allowing an admin to revoke a departing employee's access to every shared credential in one action, without requiring the credential itself to be changed.
How do enterprises manage and reduce credential-based security risk from password sharing?
The most effective approach replaces informal sharing (email, shared documents, sticky notes) with a business password manager that maintains a centralized, auditable record of who has access to each shared credential. This makes it possible to answer “who currently has this password” at any point, and to revoke individual access cleanly when it is no longer needed, particularly at offboarding. Plus, secure sharing with non-Dashlane users (like partners and vendors, potentially) is possible with Link Sharing.
How do I give new employees secure credential access from day one, and remove it just as cleanly when they leave?
SCIM integration between an identity provider and a business password manager automates both ends of the employee lifecycle: provisioning access to relevant shared credentials when the employee joins, and revoking that access automatically when they are removed from the identity provider at offboarding. This closes the gap that manual, sharing-by-request processes typically leave open.
What are the biggest credential security risks facing enterprises?
Orphaned access from incomplete offboarding remains one of the most common and most avoidable risks. Employees who received shared credentials during their tenure, for a project, a tool, or a team account, frequently retain functioning access well after they have left the organization, simply because there was no centralized way to track and revoke it.
How do security teams remediate compromised or orphaned credential access at scale?
Centralized visibility is the prerequisite for remediation at scale. An admin console that shows exactly which employees have access to which shared credentials allows a security team to identify and revoke orphaned access systematically, rather than relying on institutional memory or a manual audit that may miss credentials shared informally outside the managed system.
What are the security risks of shared passwords?
Increased security risks from hacking and data breaches can ultimately lead to lost data, money, or privacy for multiple users. Shared passwords also increase the risk of account lockouts when the passwords are updated. Traceability for important transactions is also diminished when multiple users share account or system credentials.
Are shared passwords more easily hacked?
Yes. Shared passwords are more easily hacked, especially when weak passwords are used for convenience or 2FA is not deployed. The act of sharing introduces opportunities for scams and hacking if a secure, encrypted portal is not used. Insecure sharing methods also increase vulnerability to physical password theft and data breaches.
Sign up to receive news and updates about Dashlane
