Where possible, do not casually send your main account password through ordinary email, SMS or chat. A separate user, delegated access or temporary credential is usually better when the provider supports it.
What should I use instead?
- Separate user access: create a user or collaborator specifically for the work.
- Delegated access: some providers let you grant another person or business access without revealing your password.
- Temporary credentials: where separate access is unavailable, a temporary password can reduce how long a shared credential remains useful.
- Secure sharing: use the secure method agreed for the project rather than putting credentials into a public form, URL or casual message.
What should I never send?
Do not send banking passwords, personal email passwords or unrelated account credentials. Toolbelt Websites should only receive access relevant to the website task.
If an account uses two-step verification, do not disable it simply to make sharing easier. Follow the provider's legitimate delegated-access or verification process where available.
What should I do after the work?
If temporary access was created, change or revoke it when it is no longer required. If a separate user was created, remove or reduce its permissions when appropriate.
See How can I securely provide login details? and Can I create a separate hosting login for Toolbelt Websites?.
Last updated: 8 September 2026