Sharing admin logins securely with colleagues or partners
The weight of admin credentials
Admin credentials are different from regular user credentials. They typically grant unrestricted access to a system — the ability to create and delete accounts, modify configurations, access all data, and in many cases take actions that cannot be undone. Sharing them carelessly is not just a security risk; it's an operational risk.
Yet sharing admin credentials is sometimes genuinely necessary. A partner needs to configure something. A managed service provider needs to troubleshoot an issue. A colleague is covering while you're on leave. The question isn't whether to share — it's how to do it without creating a permanent vulnerability.
Why admin credentials deserve extra care
The consequences of an admin credential being compromised are proportionally more severe than a regular user account being compromised:
- An attacker with admin access can create backdoor accounts that persist even after the password is changed
- They can exfiltrate the entire user database, including other credentials
- They can modify audit logs to hide their activity
- They can lock out legitimate administrators
For systems containing personal data, an admin credential breach is almost certainly a reportable data breach under GDPR and similar regulations. The cost of that — in investigation, notification, and potential fines — far exceeds the inconvenience of handling credential sharing properly.
Principles for sharing admin credentials
Prefer delegation over sharing Most platforms allow you to create additional admin accounts or grant elevated permissions to specific users. This is almost always better than sharing a single credential. Each person gets their own login, actions are attributable to specific individuals, and access can be revoked per user without disrupting everyone else.
When sharing is unavoidable, use one-time links If you must share a credential directly — perhaps the system only supports a single admin account — use PassTransfer to create an encrypted one-time link. The recipient retrieves the credential once; the link expires. Nothing sits in email or chat history waiting to be found.
Set a time limit on the access Before sharing, agree on how long the access is needed and when it ends. "I'm sharing this for the maintenance window tonight, 21:00 to 23:00. I'll change the password at 23:00 regardless of whether the work is complete." Then follow through.
Change the password after every temporary share Without exception. It takes 60 seconds and eliminates the risk that someone you shared the credential with still has it in their password manager, email, or memory.
Document every share Keep a record of who received which credentials and when. This serves two purposes: it enables proper rotation discipline, and it creates an audit trail if something goes wrong later.
Working with external partners and MSPs
When a managed service provider or external partner needs admin access, treat it with the same rigour as any third-party access:
- Create a dedicated admin account for them where possible
- If sharing your own credentials, use PassTransfer and change the password immediately after their work is complete
- Require them to confirm when their work is done so you know when to rotate
Conclusion
Admin credentials require a higher standard of care than ordinary passwords. Combine the principle of minimum necessary access — separate accounts where possible — with secure one-time delivery for the cases where direct sharing is unavoidable. And always rotate after the fact.
