passwords and backups
Logins, sign-in codes and backups
The usual advice is “don’t write passwords down”, which is right, and then nothing about what to do instead. Here is what we recommend, best first, so the people who own a website can still get in if you can’t.
Logins
- A shared vault the client owns, with you as a member. The client’s logins live in their own password manager, and you are invited in. If you are not there, nothing changes for them. How a client sets one up. 1Password and Bitwarden both have shared vaults for organisations. For a client who uses Apple devices, the Passwords app can share a group of logins with people you choose.
- Your password manager, with emergency access. Some password managers let you name someone who can ask for access, which you can refuse within a waiting period. Bitwarden calls this Emergency Access.
- Your password manager, with its master password sealed with your executor. Write down only the one master password and the recovery kit, seal them, and leave them with your executor or solicitor, with your will. 1Password’s Emergency Kit is made for this.
- Written down. The National Cyber Security Centre’s concern is passwords written down “where they can be easily found”. Never on a note by the computer. If you must, sealed and kept with your executor.
- Only in your browser or Apple Keychain. If you can’t be reached, no one can get them. Apple’s Legacy Contact gives family access to photos and files, but not to Keychain passwords.
A security key is not a password store. Keys such as YubiKey are a second way of proving it’s you. They hold no passwords, and if only you have one, they are another way to be locked out. Register a spare.
To pass on a password once, use an encrypted link that expires, such as Bitwarden Send or a 1Password share link. Not email or a text message. The person receiving it doesn’t need an account, and should then save it in their own vault.
If you own the website: set up your own vault
This is the most useful thing a website owner can do. Whoever sets up a vault owns it, so it needs to be you or someone in your organisation, not the person who built your site. Then you invite them in.
Choose a password manager
See the table below. Any of them is far better than none.
Set it up in your organisation’s name
Use an email address the organisation controls, such as office@, rather than someone’s personal one. Pay with the organisation’s card. If there’s a second person who should be able to get in, such as a trustee or partner, make them an admin too.
Invite your web builder
Add them as a member so they can add and update logins. You can remove them at any time, and the logins stay with you.
Ask them to move the logins in
The domain registrar, hosting, email, the website’s admin and any other services in your continuity plan, with each account’s recovery codes.
Keep the way back in somewhere safe
Print the recovery kit, such as 1Password’s Emergency Kit, and keep it with the organisation’s important papers, not on the computer.
| If you are… | Use | Cost |
|---|---|---|
| One person, and you and your builder both use Apple devices | A shared group in Apple’s Passwords app. You create the group, so only you can add or remove people. Everyone needs iOS 17 or macOS Sonoma or later, and your builder must be in your contacts. | Free |
| One person, and not everyone uses Apple | A free Bitwarden organisation, which is just for two people: you and your builder. | Free |
| A business, charity or club | 1Password Teams or Bitwarden Teams, with room for more people and an admin who can remove anyone who leaves. | Monthly. See 1Password’s and Bitwarden’s prices |
If you build websites: ask each client to set up the vault and invite you. It can be tempting to create it in your own account and add the client as a guest, because it’s cheaper, but the vault would still be yours, and it would go if your account did.
Two-step sign-in codes
This is the most common way people get locked out: they have the password, but the code goes to a phone they don’t have.
- Add the client’s phone, or a second security key, to the domain registrar, hosting and email accounts.
- Save each account’s recovery codes in the shared vault.
- Check which sign-in methods each service offers on 2FA Directory.
- Turn on two-step sign-in wherever it isn’t on yet, starting with the domain registrar.
Backups
Keep three copies, on two different kinds of storage, with one away from the hosting company, and at least one in the client’s own account. Then, once a year, try restoring one. A backup no one has restored may not work.
| If the site is… | Back up | Where to |
|---|---|---|
| Built from code (Astro, Vite, Next.js) and hosted on Vercel, Netlify or similar | The code. The repository is the backup. | A repository the client owns or can reach, such as a GitHub organisation, not only your own account |
| Using a content editor or database (WordPress, Tina, Supabase, MediaWiki) | The content and the database, every night or week | The client’s own Google Drive, Dropbox or cloud storage such as Backblaze B2, outside the hosting account |
| Made with a site builder (Wix, Squarespace) | An export of pages, images and form entries, where the builder allows it | The client’s own storage |
| Usually nothing: the provider keeps it. Export a copy once a year if old mail matters | The client’s own storage |
The host’s own backups are welcome but don’t count as the off-site copy: if the account is closed or unpaid, they go with it.
How often, and how far back
- Automatic, not by hand. Copies made when someone remembers stop when people get busy.
- Every day for a site whose content changes often, such as a wiki, shop or membership site. Every week is enough for one that rarely changes.
- Keep at least a month of copies. A hack or mistake is often found days or weeks later. If only the latest copy is kept, the damage has already been copied over it.
- Online and physical. A drive at home or in the office is a good second copy, but a fire, flood or theft takes it with the computer. Keep one copy online, in storage the client owns.
Expiry dates
Domain names, certificates, hosting plans, app store memberships and API keys all run out. In Spare Key, give each service its renewal or expiry date, then use Add the dates to a calendar in step 06. Every date goes into your calendar, with reminders 30 days and 7 days before.
Sources
- National Cyber Security Centre: password guidance
- Apple: share passwords with people you trust
- Bitwarden: Emergency Access
- 1Password: Emergency Kit
- Apple: Legacy Contact
Spare Key never asks for a password, and never stores one. Check it yourself.