Setting Up a Password Manager for Your Assistant: A Practical Guide

The most common security mistake leaders make with a new assistant is sending passwords by email or chat. It's understandable — the assistant needs access, and it's quick. But credentials in a chat history or inbox are easy to leak, hard to rotate and impossible to audit.

A password manager solves this. This guide explains how to set one up for an assistant relationship, how to structure vaults and how to combine it with multi-factor authentication and delegate access.

Principles first

1. Use delegation where the platform supports it. Many platforms let you grant another user access to your mailbox, calendar or account without sharing your password. That's better than any shared credential.
2. Share credentials only through a password manager. Never by email, chat, text or documents.
3. Use company-controlled accounts. The password manager should belong to your company, so access survives staff changes.
4. Least privilege. Share only what the assistant's tasks require.
5. Multi-factor authentication everywhere. Guidance from CISA and NIST consistently recommends MFA as one of the most effective account protections.

Step 1: Choose a business password manager

Choose a business or team plan from an established password manager. Common options include 1Password, Bitwarden, Keeper, Dashlane and LastPass business tiers. Evaluate:

• Shared vaults or collections with permission controls.
• Admin console to add and remove users.
• Activity or audit logs.
• Support for passkeys and MFA codes.
• The provider's security documentation and independent audits.

Step 2: Structure vaults by function

Organize shared credentials into vaults by purpose, not by person:

• Executive — Travel: airline, hotel and car-rental loyalty accounts; travel booking tool.
• Executive — Subscriptions: news, research and professional subscriptions.
• Operations — Vendors: vendor portals, utility accounts.
• Finance — Read-only: bank and card portals with view-only access, if needed.
• Marketing: social media management tools.

Grant the assistant access only to the vaults their role needs. Keep your personal and most sensitive credentials — primary bank login, personal email, admin accounts — in your private vault.

Step 3: Prefer user accounts over shared logins

For business tools — CRM, project management, helpdesk, accounting — create a named user account for the assistant with an appropriate role. Named accounts:

• Give each person their own audit trail.
• Can be disabled without affecting anyone else.
• Support role-based permissions.

Shared logins should be the exception, used only where a platform doesn't support multiple users.

Step 4: Set up delegate access for email and calendar

Major email platforms support delegation:

• Google Workspace lets you grant mail delegation and calendar sharing to another user in your organization.
• Microsoft 365 supports mailbox and calendar delegate permissions.

With delegation, your assistant uses their own account to manage your mailbox and calendar. You can see and revoke access at any time, and your password stays private. Check your platform's current documentation for setup steps.

Step 5: Handle MFA thoughtfully

MFA is essential, but it complicates shared access. Options:

• Named accounts with their own MFA: best. The assistant has their own account and their own second factor.
• Time-based codes stored in the password manager: for shared accounts that can't support multiple users, many password managers can store the TOTP secret so authorized users can generate codes. This is a trade-off; use it only where needed and restrict access.
• Avoid SMS codes routed to your personal phone for accounts the assistant uses daily — it creates friction and encourages workarounds.

Step 6: Set rules for financial accounts

Financial access deserves extra caution:

• Prefer view-only or limited roles for bank and card portals.
• Use spend-management tools with individual cards and limits rather than sharing a company card number.
• Require your approval for any payment, new payee or change in payment details.
• Never let any request to change payment details be approved based on email alone — see payment fraud controls.

Step 7: Document and review access

Keep a simple access register:

Review it quarterly and remove anything unused.

Step 8: Plan for offboarding

Offboarding is where a password manager pays off. When an assistant leaves:

1. Remove them from the password manager.
2. Rotate credentials in shared vaults they could access.
3. Disable named accounts and remove delegations.
4. Review the access register.

See offboarding a remote assistant securely.

Common mistakes

• Sharing your primary email password. Use delegation instead.
• One giant shared vault. It defeats least privilege.
• Personal password manager accounts. Access disappears or lingers when people leave.
• Skipping MFA "temporarily." Temporary tends to become permanent.
• Storing passwords in a spreadsheet "just for now." Same problem.

How ExecWing approaches this

ExecWing assistants work in your systems, under your access policies. We ask clients to share credentials through a password manager, use named accounts and MFA, and limit financial access. Our assistants sign confidentiality agreements. See our security page and data security for remote assistants.

A setup checklist

• [ ] Business password manager chosen; company-owned
• [ ] Vaults structured by function
• [ ] Assistant granted only required vaults
• [ ] Named user accounts created for business tools
• [ ] Email and calendar delegation configured
• [ ] MFA enabled on all accounts
• [ ] Financial access limited; payment approvals defined
• [ ] Access register created
• [ ] Offboarding steps documented

Rolling it out in an afternoon

If you're starting from nothing, a realistic first session looks like this:

1. Sign up for a business plan and enable MFA on the admin account (15 minutes).
2. Create three or four function-based vaults (10 minutes).
3. Move the credentials your assistant needs in the first month into those vaults, changing any passwords that were previously shared by email or chat (45–60 minutes).
4. Set up email and calendar delegation in your platform (15 minutes).
5. Invite your assistant and walk them through the vaults on a short call (20 minutes).

Then add credentials gradually as you delegate new tasks, rather than migrating everything at once.

Quick answers

Should my assistant have access to my personal accounts? Only if you deliberately delegate personal admin, and then only the specific accounts needed, in a separate vault.

Is a browser's built-in password manager enough? For a business relationship, a dedicated business password manager with admin controls and shared vaults is a better fit.

The bottom line

Never share passwords by email or chat. Use delegation where you can, named accounts where possible, and a company-owned password manager with function-based vaults for everything else. Add MFA, limit financial access and keep an access register. You'll give your assistant what they need — and nothing they don't.