sparekey

guide

Make your first handover in fifteen minutes

Everything you need to know to use Spare Key, whether you build websites or someone builds yours.

I build websitesI own a website

Builders map a client’s setup and write the handover. Owners send a request to the person who looks after their website.

six stepsFrom domain name to handover

  1. People

    Add the client, yourself, and an emergency contact: someone who could reach your accounts if you couldn’t, such as your executor.

  2. Domains

    Type each domain. Spare Key reads the public records: registrar and renewal date, DNS host, website host, email provider, who can send as the domain, and the certificate.

  3. Services

    Each finding becomes a service. Record whose name it’s in, who pays, and whether a second person can manage it. Add what the lookup can’t see.

  4. Access and backups

    Say where the passwords and backups are kept. Never type the passwords themselves.

  5. Risks

    See what would break without you, most serious first. Fix what you can and watch the list shrink.

  6. Hand over

    Download the Word document for the client and save the inventory file. Yellow highlights are gaps still to fill.

what the risks meanEach one, and how to fix it

Serious

Only you can manage a service

The account is in your name and no one else can get in.

Fix: add the client or a trusted helper as an admin, or move the account into the client’s name.

Serious

Email on a privately run server

If whoever runs that server stops, email stops, often without warning.

Fix: move email to a service in the client’s own name.

Serious

Wrong or expired certificate

Visitors see a security warning, and many leave.

Fix: ask the host to reissue it for the right name.

Fix soon

Domain renewal

A lapsed domain takes the website and email down, and anyone can then buy the name.

Fix: turn on auto-renew and keep the card current.

Fix soon

Paid by you

When your payments stop, the service stops too.

Fix: move the bill to the client.

Check

No SPF or DMARC

Mail is more likely to land in spam, or be spoofed.

Fix: add the records your mail provider gives you.

jargon busterThe words you’ll see, in plain English

Domain name
Your address on the internet, like example.org. You rent it yearly from a registrar.
Registrar
The company you rent the domain from, such as GoDaddy or Namecheap.
DNS
The settings that point your domain at your website and email.
Hosting
The service that stores your website and shows it to visitors.
MX record
The DNS setting that says where your email is delivered.
SPF and DMARC
DNS settings that tell other mail servers who may send email as you.
Certificate
What makes the padlock appear. It must match your domain and be renewed.
RDAP
The public registry record that shows who a domain is registered with and when it renews.
Inventory file
The .json file Spare Key saves. It holds no passwords, so you can keep it anywhere and open it again next year.

templatesRather fill it in yourself?

The same continuity plan as blank templates. Nothing to sign up for, and nothing leaves your computer.

Word templateThe continuity plan with examples to replace. Print it or keep it in your own cloud storage..docx · 5 pages Excel inventoryServices, domains and contacts, with drop-downs. It flags risks and renewals for you..xlsx · 4 tabs

questionsFrequently asked

I don’t build websites. Someone looks after mine. Can I use this?

Yes. Go to For website owners, fill in a few details, and we write an email for you to send to your web person. They complete the handover and send it back to you.

Can I fill it in without the tool?

Yes. Download the Word or Excel template and fill it in by hand.

Is anything I type stored on your server?

No. There is no Spare Key server. Lookups run in your browser and send only the domain name, to public lookup services. Everything else stays in your browser until you save the inventory file. Check it yourself.

Why doesn’t it store passwords?

A service holding the keys to other people’s accounts would be a target, and would itself become a single point of failure. Record where passwords are kept instead, for example a password manager your client can reach.

What does my client get?

A plain-English Word document explaining what their website and email depend on, who pays for what, what to do in the first week if you were unable to work for a long time, and what still needs fixing. Give them the inventory file too, so anyone can update it later.

The lookup says “Unrecognised”. What does that mean?

Spare Key recognises the common registrars, hosts and email providers. If it cannot tell who a provider is, it says so rather than guessing. Edit the service and type the provider’s name.

Why is the renewal date missing?

Some registries do not publish registration data in a form Spare Key can read. Look the date up in the registrar’s account and add it to the registration service.

How do I update a handover next year?

Open the inventory file with “Open inventory”, press “Check again” on each domain, update anything that has changed, and download a fresh document.

Can I use it for my own websites?

Yes. Put yourself in as the client and a family member or friend as the emergency contact.

What if this website disappears?

Nothing breaks. The documents and inventory files work without it, the file format is published, and the code is open source, so anyone can run their own copy.

Does it cost anything?

No. It is free and open source.

Something missing? Suggest it.