How to share account access without losing control

The one rule: give access, never give your identity

Your main email account and the recovery details on your accounts are your digital identity. Whoever controls them controls everything, including the ability to lock you out. So the rule is simple: other people get their own login, their own role, or a shared entry in a password manager. They never get your email password, and recovery email addresses and phone numbers always stay yours.

Sharing with family, the right way

For couples and families the goal is shared convenience without a single point of failure.

1. Use a password manager with family sharing. You each keep your own vault and share only the specific logins you both need, like streaming or utilities.
2. Use the platform's built-in family features for purchases, photos and subscriptions on Apple and Google, instead of everyone using one account.
3. For emergencies, set up each provider's official legacy or emergency access feature rather than writing master passwords on paper.

Sharing in a small business

Businesses lose control fastest, because access gets handed out in a hurry and nobody writes it down. Use roles, not shared logins, everywhere they exist.

1. Accounting software: invite your bookkeeper or accountant as their own user with an adviser role. Never share the owner login.
2. Email: use delegated access or a shared mailbox so staff can send and read without knowing a password.
3. Social media: add staff as page users or editors with their own logins. The page owner role stays with you.
4. Banking: ask your bank about card or user limits and authorisation levels for staff instead of sharing internet banking credentials.

Sharing with your IT person or web developer

This is the one that hurts businesses most when it goes wrong, because the assets involved are the business. Two things must always remain registered to you and in your name: your domain name and the email account everything resets to.

1. Domain names: the registrant must be you or your business, never the IT provider. Most registrars and hosts have delegate or additional user features for the day-to-day work.
2. Websites: give your developer their own admin user on the site, not your hosting account password.
3. When you engage someone new, create access for them on day one the proper way. It takes ten minutes and sets the pattern.

Keep a simple access register

None of this works if you cannot remember who has what. Keep one simple list, on paper or in a note: the service, who has access, what kind, and when it was granted. Five lines is enough for a household. A page is enough for a small business. When someone asks for access, you add a line. This one habit is the difference between offboarding in ten minutes and hunting for a week.

Taking access back: the offboarding checklist

When an employee leaves, a provider changes, or a relationship ends, work through your register the same day.

1. Remove or disable their user on each service in the register. Removing a user is clean, and nothing else changes.
2. Where something was genuinely shared, change that one password and update it in the password manager.
3. Check each important account's signed-in devices and connected apps, and sign out anything of theirs.
4. Confirm recovery email addresses and phone numbers on your key accounts are still yours.