Offboarding Checklist for Shared Credentials

Disabling a leaver’s own account is only half the job. Every shared password, API key and recovery code they ever saw is still valid, and still known to them. An offboarding checklist for shared credentials closes that gap.

Step 1: List what they knew

• Shared accounts for tools, social media and vendor portals.
• Wi-Fi, building and device passwords.
• API keys, tokens and service accounts they created or used.
• Recovery codes and authenticator access on shared accounts.

Step 2: Rotate before or on the last day

1. Change each shared password.
2. Rotate API keys and tokens, and update the systems that use them.
3. Replace recovery codes and review multi-factor devices on shared accounts.
4. Revoke any personal access tokens and active sessions.

Step 3: Share the new credentials safely

Give each remaining team member the new credential through a one-time link rather than a message, so the new password does not sit in a channel the leaver could previously read. Use a short expiry and ask people to confirm they have saved it.

Step 4: Check the less obvious places

• Shared mailboxes and distribution lists.
• Scheduled jobs or integrations that run with the leaver’s credentials.
• Personal devices that still hold company data.
• Documents and notes that contain credentials.

Step 5: Record and improve

Write down what was rotated and when. Over time, move shared logins to individual accounts so offboarding means disabling one account instead of rotating many.

A sample timeline

1. When notice is given: start the inventory of shared credentials the person knew.
2. During the notice period: move shared logins to individual accounts where possible.
3. On the last day: rotate every remaining shared secret and revoke tokens and sessions.
4. The same day: deliver the new credentials to the team through one-time links.
5. One week later: check logs for sign-ins that should not be happening and close the checklist.

Who should do what

• The manager lists the systems the person used.
• IT or security rotates credentials and checks service accounts.
• HR confirms the leaving date and returns of equipment.
• Team members confirm they have saved their new credentials.

Make the next offboarding easier

Each time you offboard someone, note which shared logins you had to rotate and ask whether each could become an individual account instead. Over a year, the list of shared credentials shrinks, and the checklist gets shorter.

Frequently asked questions

Is disabling the leaver’s account enough?

No. Any shared password, API key or recovery code they knew still works until you change it.

When should credentials be rotated?

On or before the leaver’s last day, depending on the sensitivity of the access.

How do I give the new passwords to the team safely?

Send each person a one-time link with a short expiry, rather than posting the new password in a channel.

A safer way to share secrets

Roll out new credentials without leaving them in chat. Create a one-time secret link. By default, SecureVoult shows a secret once and then deletes it, so nothing is left behind in email, chat or tickets.

Keep reading:

• Share credentials with clients