Sharing passwords is a common and often unavoidable practice that can make you vulnerable to hacking and data breaches. Let’s discuss what password sharing is and how it can be done safely.
What is password sharing?
Password sharing occurs when you give your login information to friends, family, coworkers, or others so they can use your accounts or applications on their own devices, even when you are not there. One survey survey showed that 79% of people share their passwords.
Passwords can be shared in a variety of ways, including:
- Phone calls and paper notes: WiFi passwords or streaming service credentials are often shared informally over the phone, on sticky notes, or on scraps of paper that are inherently not secure and can easily be misplaced. Equally problematic are passwords for workplace applications taped to laptops and monitors. Sharing passwords over the phone isn’t ideal because sometimes it can be hard to communicate the correct password, especially if it’s complex and random like a strong password should be). Sharing passwords over the phone in public also isn’t safe, as you never really know who’s listening.
- Electronic password sharing: Password sharing at work is complicated by remote working practices. Many passwords are shared through unsecured channels such as email, Slack, or text messages, which could be exposed during a data breach. While companies usually establish policies to manage passwords across the business and discourage unsecurely shared passwords, these electronic methods are still commonly used to share passwords for both business and personal accounts.
- Encrypted password sharing: Luckily, there are now safer, more private shared account password management methods available. Password managers like Dashlane use a secure vault for password storage and also include an encrypted portal for password sharing. This allows users to transfer passwords and other sensitive data securely without sacrificing privacy or increasing vulnerability.
What accounts are most commonly shared?
The most commonly shared password types should be easy to guess since many of us have shared these ourselves. It’s critical to remember that any of these passwords, no matter how inconsequential they seem, present unique risks if they're ever lost or stolen.
Passwords commonly shared at home:
- Subscription accounts: Passwords for online retail and subscription accounts like Amazon or Netflix are commonly shared with friends and family members. These accounts also contain financial information like credit card and bank account numbers, so it’s important to keep careful track of who you share them with and change passwords if you suspect a data breach or find your information on the dark web.
- Financial accounts: Bank passwords are often shared with spouses or partners, especially for joint accounts. These passwords should always be complex, unique, and stored securely. Many financial institutions have implemented 2-factor authentication (2FA) to verify authorized user identity and minimum character counts to increase password security.
- WiFi access passwords: Sharing WiFi passwords with housemates and guests is often unavoidable, but this presents security risks if the logins are not shared safely. If someone gains access to your home WiFi network without your knowledge, any misuse of internet services can be blamed on you, or malware could be spread amongst your devices. Guest networks and one-time passwords are among the available options for boosting WiFi password protection. If you’re using WiFi that was shared with you, be sure to use a VPN to further protect yourself from vulnerabilites.
- Email accounts: Much like subscription and retail accounts, email passwords are often shared with partners for convenience. Lost or stolen email passwords allow your contact lists and personal information to be compromised. Since email can also be used as 2FA for other accounts, compromised email credentials can expose the accounts of both partners to hacking and data theft.
Passwords commonly shared at work:
- Social media accounts: Unlike personal Linkedin, Facebook, X, and Instagram accounts, social media accounts for businesses are often accessible to multiple employees so that posts can be added more conveniently. These social media accounts are essential to company reputation and branding, so password access and sharing should be monitored and controlled according to the employee password sharing policy, especially when workers join or leave the company.
- Company credit cards: When employees share a credit card, they also share online account access. Many companies assume that issuing fewer company cards and allowing users to share them is the preferred strategy, but this convenience can come at the expense of security if companies are unsure of who is using the card or fraudulent transactions are suspected.
- Shared utilities and tools: Application sharing is a common company strategy used to reduce seat licensing fees, though cloud-based applications are moving away from these per-seat licensing models. Unique logins for each employee improve security and compliance by allowing companies to monitor who has been granted application access and who is working on or changing company systems at any given time.
- Company email: Much like with personal email, shared passwords for work email accounts can expose the data and confidential information of multiple users in the event of a data breach. Shared email accounts also create privacy and confidentiality concerns when company emails can be read or sent by someone other than the account holder.
The dangers of password sharing
Password sharing without taking proper precautions can expose you to the following dangers:
- Cybercrime and scams: Cybercrime tactics include phishing emails intended to lure unsuspecting individuals into clicking on unsafe links or providing personal information, and brute-force attacks in which cybercriminals randomly enter password and username combinations until a match is found. Scamming tactics like fake websites get targets to provide account information or passwords voluntarily.
- Turnover: With more workers changing jobs frequently, employers are taking precautions to prevent data theft when employees turn in their devices and network access is terminated. Shared account passwords can complicate the offboarding process since, without the right tools, employers and IT teams won’t know for sure who had access to what. This can lead to unnecessary password resets or compromised company data.
- Tracking: Shared passwords make it harder to know who purchased, ordered, changed, or canceled online goods and services. This applies to organizations and individuals alike---accountability is important for even the most trusted employee or family member. The same danger applies at home, even for passwords shared with trusted family and friends.
How to share passwords securely in the workplace
Since password sharing is unavoidable in many circumstances, it’s a good idea to review how to share passwords more securely by using some of the available tools and best practices:
- Secure password policies: In the workplace, a secure password policy can be used to set norms and expectations for things like password strength, reuse, storage, and sharing. Employee education and training on the policy and user-friendly password management tools help to close the loop and build a sustainable security culture with improved adoption and compliance.
- Careful access management policies: Access management policies control system access for each user, which reduces shared password risks. The principle of least privilege (PoLP) works by limiting employee access to only the minimum applications and resources they need to complete their work. Just-in-time policies set predetermined access time limits so that shared passwords or retained passwords will not work indefinitely and the risks from lost or stolen passwords are minimized.
For IT and security teams, the principle of least privilege and just-in-time access are policy concepts; implementing them at scale requires a way to automatically grant, adjust, and revoke access as employees join, change roles, or leave.
Dashlane Confidential SSO & Provisioning provides exactly this mechanism. It integrates with leading identity providers (Okta, Azure AD, and Google Workspace, among others) to automate user provisioning and deprovisioning through SCIM, and supports Just-in-Time provisioning so new employees are granted Dashlane access automatically the moment they log in with their verified SSO credentials, all without requiring a manual admin step for every hire.
This closes the gap that shared passwords create. Rather than employees sharing a single credential across a team account, each employee receives individual, SSO-authenticated access to Dashlane, with the specific shared credentials their role requires provisioned automatically. When an employee’s role changes or they leave the organization, access adjusts or is revoked the same way through the identity provider, not through a manual password rotation exercise.
The least-privilege and time-limited access principles described above become an automated, auditable process rather than a policy that depends on manual enforcement.
How to share passwords securely
Dashlane’s password manager includes a secure password sharing portal that allows you to transfer credentials to other Dashlane users securely. Since the information is encrypted and passwords are safely autofilled, there’s no need to use online communication platforms or paper notes.
Link sharing also enables Dashlane users to securely share passwords and other sensitive information with non-Dashlane users with a link that expires after one view or 24 hours.
Frequently asked questions
How do I enforce the principle of least privilege for password and credential access at scale?
The principle of least privilege requires that access permissions be tied to a governed source of truth, typically the organization’s identity provider, rather than managed manually per application. Dashlane Confidential SSO & Provisioning integrates with identity providers like Okta, Azure AD, and Google Workspace so that an employee’s Dashlane access, and the shared credentials provisioned to them, are automatically scoped to their current role and group membership. When that role changes, access updates through the same identity provider integration rather than requiring a manual review of application-level permissions.
How do I give new employees secure credential access from day one?
With SSO and SCIM provisioning configured, new employees are granted Dashlane access automatically at their first login using their existing SSO credentials, with Just-in-Time provisioning eliminating the need for a manual admin step per hire. Shared team credentials relevant to their role are available immediately, replacing the informal sharing methods described elsewhere in this article, such as passwords taped to a monitor or sent over Slack.
How do enterprises manage and reduce credential-based security risk tied to shared passwords?
Centralizing password sharing through a business password manager rather than informal channels addresses the immediate exposure. Pairing that with SSO and SCIM-based provisioning addresses the underlying access management problem. Instead of a shared password that grants indefinite access to anyone who has it, access is scoped to the individual employee’s verified identity and automatically revoked when their role or employment ends.
What happens to shared credentials when an employee leaves the company?
This is one of the turnover risks described earlier in this article. Without the right tools, IT teams may not know for certain who had access to which shared passwords. With Dashlane Confidential SSO & Provisioning, deprovisioning an employee in the identity provider automatically removes their Dashlane access, including any shared credentials they had been granted. This closes the access gap immediately rather than relying on a manual credential rotation after the employee’s departure.
What's the easiest way to roll out secure, centrally managed password sharing across an organization?
Dashlane Confidential SSO & Provisioning is designed to integrate with an identity provider an organization already uses, so rollout follows the same pattern as deploying any other SSO-connected application. Employees authenticate with their existing corporate credentials, and Just-in-Time provisioning means broad enrollment does not require a manual account creation step for every employee.
Sign up to receive news and updates about Dashlane
