# How to Share Passwords with a Developer Safely

> The safest way to share passwords with a developer is not to share yours at all: create a separate account for them with only the permissions the job needs. Otherwise, send it through an expiring password manager link, never plain email. Once the job is signed off, delete the account or change the password.

- URL: https://kleinerauftrag.de/en/delivery/share-passwords-with-developer/
- Language: en
- Updated: 2026-10-19
- Publisher: Kleiner Auftrag (OnlineBuilders LLC, https://onlinebuilders.biz)

Picture the life of a password sent by email. It sits in your Sent folder and the developer's inbox. Both get backed up. Both get indexed for search. Twelve months on, nobody remembers it exists, and it still opens your shop's admin area, because nobody changed it after the job.

The developer you trust isn't the risk. The risk is every place the password keeps lying around afterwards.

## Accounts, not passwords

Nearly every system that small jobs touch allows more than one user. That's the safest route and usually the simplest: create an account for the developer with their own email address, their own password and their own second factor.

Three things improve at once. You never hand over your own password. Logs show who changed what. And when the job is done you delete one account, without changing anything for yourself.

Then apply least privilege. Someone editing some text doesn't need access to payment settings. One installing a plugin does. Give what the job needs. Nothing more.

## Platform by platform

**WordPress.** Under Users, add a new user and choose a role. Standard single-site installs have five roles, from Administrator down to Subscriber. Installing plugins and editing themes needs Administrator. Content work only needs Editor. If an outside tool needs access through the API, WordPress has had application passwords since version 5.6. According to the [WordPress core documentation](https://make.wordpress.org/core/2020/11/05/application-passwords-integration-guide/) they work for the REST API and the older XML-RPC interface but can't be used to log into the admin, and each one can be revoked individually.

**Hosting.** Many hosts let you add extra SFTP users, often restricted to a single folder. The main login to your hosting account, the one that can cancel contracts and move domains, is something a developer almost never needs for a small job.

**Hosted shops.** Shopify and similar platforms offer staff accounts with permissions you pick one by one. Shopify also has collaborator accounts for Shopify Partners: the agency or freelancer sends a request, you accept it and set the permissions. A four-digit request code limits who can ask in the first place.

**Google tools.** Search Console and Analytics each have their own user management, and so does Tag Manager. Invite the developer's email address with a suitable role and your Google password stays with you.

**Domain and DNS.** Often the simplest option is to set the DNS records yourself, using the values the developer sends you. It takes five minutes. Control of your domain, which your website and email both depend on, stays entirely with you.

**Ways to give a developer access**

| | Own account | Password manager link | Password by email |
|---|---|---|---|
| Your password stays with you | yes | no | no |
| Shows who changed what | yes | no | no |
| Expires automatically | no | yes | no |
| Easy to end after the job | yes | change password | change password |
| Lingers in mailboxes afterwards | no | no | yes |

## When you have to share a password

Some services only have one login. Then the password has to travel, and there are better vehicles than email.

Germany's federal cyber security agency, the BSI, says that using a password manager is usually worthwhile, not least because it makes a unique strong password for every account practical. Common password managers can also share individual items. 1Password can share an item via a link that you can restrict to specific email addresses, and the recipient doesn't need a 1Password account. Bitwarden's Send feature creates encrypted links for text and files that, according to the [Bitwarden help centre](https://bitwarden.com/help/about-send/), are deleted after 31 days at most. You can also cap the number of views and add a password to the link.

No password manager? Then split the channels. Username and URL by email, password by text message or phone. Intercepting one message gets an attacker very little.

What you should never do: switch off two-factor login to make it easier for the developer. That second factor is often the only thing standing between a leaked password and someone else in your admin area.

## Data protection: when the developer can see customer data

Give a developer admin access to your shop and they can see customer names and orders. That means they're processing personal data on your behalf, and [Article 28 GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) requires a data processing agreement for that. UK GDPR has the same rule. The agreement covers, among other things, that the developer only processes the data on your instructions and keeps it confidential.

That sounds like heavy paperwork for a two-hour job. Freelancers who regularly work on shops sometimes have a ready-made agreement they sign once. Ask before you create the account. Where possible, a staging copy with customer data removed or anonymised is the better workspace anyway. Then the question often doesn't arise.

## If the password has already gone out by email

No need to panic. Worth five minutes, though. Change the password once the job is finished. Check the user list for accounts you don't recognise. WordPress lists all users with their roles under Users, and many other systems show active sessions you can end.

Then delete the email from your Sent folder and ask the developer to do the same. It won't vanish completely, since mail servers keep backups. But the password inside no longer works, and that's what counts.

If you use the same password anywhere else, especially for your email account, change it there first. Whoever controls your inbox can use "forgot password" to get into nearly everything else. That's also why the BSI recommends two-factor login for important accounts, email in particular.

## Checklist: granting and removing access

The second half gets forgotten. An account left active after the job is an open door, even if nobody suspects the developer of anything. Laptops get stolen. Password managers get breached.

**Access for a small job**

- [ ] Before: back up files and database
- [ ] Create a separate account with its own email and a suitable role
- [ ] Keep two-factor login switched on for the new account
- [ ] If customer data is visible: sign a data processing agreement
- [ ] If a password must be shared: expiring link, never plain email
- [ ] After sign-off: delete the account or downgrade its role
- [ ] Revoke application passwords, API keys and SFTP users
- [ ] Change any password that was shared

The backup sits at the top for a reason. Whoever grants access should have a state to roll back to. Our guide on [how to back up a website](https://kleinerauftrag.de/en/delivery/how-to-back-up-a-website/) covers taking and testing one. Put access removal on its own line in your [project sign-off](https://kleinerauftrag.de/en/delivery/project-sign-off-template/) and nobody forgets it. Mentioning access arrangements in your [developer brief](https://kleinerauftrag.de/en/scoping/how-to-brief-a-developer/) also saves the first round of questions.

If your site or shop has so many logins and people involved that you've lost track yourself, that's a security topic of its own. Specialists in [cyber security](https://onlinebuilders.biz/solutions/cyber-security) can review and tidy up that kind of setup.

Start with your next job: create a separate account for the developer instead of sending your password, and put a reminder in your calendar to delete it a week after sign-off.

## FAQ

### Is it really that bad to email a password once?

It's avoidable. The email then sits in at least two mailboxes, gets backed up and indexed, often for years. If either mailbox is ever compromised, the password goes with it. An expiring link from a password manager takes the same amount of time to send.

### How does the developer get past my two-factor login?

Ideally they never need your code. With their own account they set up their own second factor. Where a system only allows one account, a quick phone call with the code at the right moment beats switching two-factor off.

### Does the developer really need admin rights?

To install plugins or edit theme files in WordPress, yes. To update content, no. Give the top role only for the length of the job, then downgrade or delete the account.

### Do I need a data processing agreement with my developer?

If the developer can see personal data while working, such as customer accounts in your shop or form submissions, very likely yes. Article 28 of the GDPR, and its UK equivalent, require a contract with set contents when someone processes personal data on your behalf.

Photo: Mx. Granger, CC0 (https://commons.wikimedia.org/wiki/File:Three_padlocks.jpg)