What is in this guide
Start by checking which accounts allow shared access, then give each adult their own authorised login wherever possible. For any household shared passwords the service permits, use controlled storage, agree who maintains the record and plan recovery before one person’s phone becomes the only way in.
The aim is practical: either adult should know how to handle an agreed household task without searching old messages or borrowing the other’s identity. That does not require opening every personal account to everyone at home.
Decide what actually needs shared access
List the services involved in shared jobs, such as checking a bill or managing a household subscription. Beside each one, write the task the second person needs to perform. Someone who only needs the payment date may not need account access at all.
Check the provider’s access rules and settings before sharing credentials. Look for an additional user, authorised contact or family-member invitation. These arrangements differ, so confirm what that person can actually do rather than assuming an invitation grants full control.
Keep individual government, work and personal accounts outside the shared-password list. myGov’s terms explicitly say you must not allow another person to sign in to or use your account. If someone needs help dealing with a service, ask that service about its supported assistance arrangements.
For bills, put dates and task ownership in your household bill calendar. Keep the question of who pays a bill separate from who is permitted to access its online account.
Keep a directory without turning it into a password list
Create a small access record for the accounts you have agreed to manage together. Suggested fields are:
| Field | What to record |
|---|---|
| Service and purpose | Recognisable name and household task |
| Account holder | Person responsible for the account |
| Permitted access | Separate login, authorised contact or permitted shared login |
| Access location | Where the authorised person finds the entry or invitation |
| Recovery responsibility | Who checks the provider’s recovery instructions |
| Last checked | Date access and contact details were reviewed |
| Unfinished task | Specific permission or setup question still unresolved |
Do not put passwords, backup codes or answers to security questions in this ordinary directory. If you already maintain a shared family contacts and account list, add these pointers there rather than creating another directory to keep current.
An entry such as “electricity account: additional-user invitation still needed” is useful. It leaves a visible task instead of suggesting access is ready when nobody has checked it.
Use separate private and shared storage
Australian Signals Directorate guidance recommends keeping passwords private and using unique, unpredictable passwords. It also describes password managers as a way to create and store credentials, protected by strong authentication.
If a service permits a shared login and you choose a password manager for it, check whether your chosen setup supports sharing that individual entry with the intended person. Do not assume a family label means every feature you need is included. Each adult should retain their own manager account and private credentials.
The Canadian Centre for Cyber Security advises against sharing the manager’s primary password. Treat that as the boundary: a household task should not require handing over the key to someone’s whole collection of accounts.
Start with one permitted shared account. Give its entry an obvious name, check the intended recipient’s access and leave unrelated entries private. Avoid copying the same password into several places that will need separate updates later.
Work through the second sign-in step
A saved password is only part of the setup if the service asks for another authentication step. Check what the provider supports for each authorised user. Follow its instructions rather than switching off protection to make handover easier. Both government cyber security sources recommend multi-factor authentication for the password manager itself.
For a genuinely shared login, ask a concrete question: can the other authorised adult complete sign-in when the usual account holder is away? If the answer depends on that person’s phone, leave the issue marked as unresolved until you have checked the supported options.
Keep the routine within the access the provider permits. Arrange the handover together, with both people checking the task and sign-in method. Leave unexpected requests to approve access outside this setup exercise.
Make recovery a separate job
The Canadian Centre for Cyber Security recommends having a recovery plan for losing access to your password manager. Read the recovery instructions for the manager and each important household service before you need them.
Record where the instructions and any provider-issued recovery material are kept, who may access them and what remains unfinished. Keep secret recovery material out of the general household directory. Follow the provider’s storage directions and choose a protected location appropriate to that material.
Look for circular arrangements. If instructions are stored only inside the account they are meant to recover, write down an alternative way to reach the provider’s help. If recovery depends on an email address or number, check that the account holder still controls it.
Do not assume a nominated household administrator can recover another adult’s personal account. Provider rules and personal consent still apply.
Try the handover before moving everything
Ask the other authorised adult to find the access record and complete one ordinary task from their own device. Choose something simple, such as locating a household subscription’s renewal information. Check the permission granted, not just whether a page opens.
If you manage things alone, use the same exercise to check your own retrieval route. A clear directory and recovery record can still be useful without a second person sharing access.
Fix the first failure before adding more accounts. It might be an unaccepted invitation, an unclear entry name or instructions nobody can find. Keep related paper records in your existing family paperwork system, with the directory pointing to their location.
Review access when household arrangements change
Assign one person to update each shared entry when its details change. Tell affected authorised users that the record has been updated, without putting the replacement password in the message.
Review access when someone moves out, a service is cancelled, a phone changes or an account holder changes contact details. Remove permissions that are no longer needed and check the provider’s instructions for ending existing access. ASD guidance says to change passwords if you think they have been compromised.
For today, finish one account: confirm its permitted users, arrange access, locate the recovery instructions and leave a dated record of anything still to do.
How we checked this
Reviewed on 30 October 2026 against Australian Signals Directorate password guidance, Canadian government password-manager advice and myGov’s account-access terms. The workflow and directory fields are editorial recommendations. No software, sharing feature or recovery process was tested.
The one-page family week
One printable page that holds the whole week: meals, school, activities and who is doing the pickup. Free, and we send one useful email a week.
One email a week. No spam, unsubscribe in a click.
