Guide · Small business

How to hand off shared passwords when someone leaves a small business

In a five-person company, “offboarding” often means reclaiming a laptop and hoping for the best. Shared Instagram, the bookkeeping login, the shipping account, and the old vendor portal may still use passwords that person knows.

Before their last day

1. List every shared account they could reach. Ask them. Check chat history. Check the spreadsheet if you have one.
2. Move each shared login into a company vault if it is not already there.
3. Confirm who still needs access after they leave.
4. Revoke their vault access on the last day, not a week later.

Change these first

• Email and domain admin
• Banking, payroll, and accounting
• Social accounts that speak for the business
• Anything that was ever pasted into chat
• Vendor portals tied to billing

Sign-out is not the same as revoke

Changing a password helps. So does reviewing active sessions and signed-in devices inside each important account. A password manager revoke stops future vault access. The service itself may still have an old session until you clear it.

Make the next departure boring

Shared business passwords should live in a shared space from day one, with names people recognize and owners who are current employees. If every login has a home, departure day is a checklist instead of an archaeology project.

Explore how StrideAuth works for small teams.