BG Beter Geregeld ICT
Toegangsbeheer · 2 min leestijd · 25 December 2025

Shared passwords: how to manage them without the headache

That one admin login for the domain registrar, the social media accounts, the customer portal. Three people know those passwords, sharing them via a spreadsheet is asking for trouble — here's how to do it right.

Some accounts have no single "owner": the master account of your domain registrar, the Twitter/X company login, the customer support inbox. These accounts need to be accessible to 2–5 people. How do you handle that securely?

Rule 1: put them in a vault

Never in a spreadsheet, never in an email, never in a Notion page. Always in 1Password, Bitwarden, or a dedicated in-app vault such as AccessGuard Vault, which supports per-user ACLs and an audit log of every decryption.

Rule 2: an explicit access list

For each shared account, record who is allowed to access it. Less is more. A social media account can easily be managed by just 2 people; there is no reason the entire company needs access.

Rule 3: rotate on change

The moment someone is removed from the access list, change the password. See offboarding step 3. No exceptions. Otherwise you are left with an account that carries a "former colleague still knows the password" footprint.

Rule 4: MFA wherever possible

Shared accounts need MFA too. Modern authenticator apps (Authy, 1Password) support shared tokens. Hardware tokens also work, but they require a physical handover process.

Rule 5: audit log

Who accessed the password, and when? If you cannot demonstrate this, you will not be able to determine whether misuse occurred during an incident. Every serious vault logs this.

What does NOT work

  • One person who knows all the passwords, with a "backup" written on paper in a safe.
  • A spreadsheet on SharePoint containing "all credentials" — even if it is password-protected.
  • Everyone-can-see-everything vaults. ACLs are your friend.

See also: privileged access management, choosing a password manager.

Onderwerpen

#security #wachtwoordbeheer #vault

Volledige gids: Control de accesos para pymes: la guía completa (2026)

Dit artikel is onderdeel van onze uitgebreide Toegangsbeheer-gids. Lees de pillar voor het complete plaatje.

Lees de pillar →

Verwant leesmateriaal

Toegangsbeheer

The least-privilege principle explained for business owners

Grant as little access as possible, for as short a time as possible. That might sound like a productivity hit — in practice, it saves you from a data breach that takes months to explain away.

2 min
Toegangsbeheer

Privileged access management for SMBs

Global Admin, AWS root, Salesforce system admin — these are the accounts that cause the most damage when compromised. Here's what you can do without buying an expensive PAM tool.

2 min
Security zonder IT-afdeling

Security for SMBs without an IT department: what should you do this quarter?

No IT team, but still accountable. This pillar gives you a priority stack: do this first, then that, then the less urgent stuff. Each item links to a deeper guide.

2 min
Security zonder IT-afdeling

Choosing a password manager for your SMB: what really matters?

Choosing a password manager isn't a matter of taste — but it's not rocket science either. A practical guide for business owners without an IT department.

6 min
Security zonder IT-afdeling

Uptime monitoring for SMBs: don't hear about it from your customers

Your website is down and you find out from a customer. There's a better way. Here's how to set up uptime monitoring as an SMB without an IT department — without drowning in false alerts.

6 min
Offboarding

Vault handover: stop credentials from walking out the door with a departing employee

Shared logins only one person knew, API keys stored in their personal vault, 2FA tokens tied to their private phone. Here's how to prevent those "oh no" moments.

2 min
← Alle artikelen in "Toegangsbeheer"