Who Has the Password? (And Who Will Have It Next?)

Every church has an access-and-accounts situation. On Tuesday, administrators from across the country and denominations Zoom-gathered at an Admin Café to talk honestly about ours. Nobody showed up with a perfect system, and that was a relief!

We started with a confession round: how often do you click "Forgot password?" From there, the stories came quickly. One administrator has worked alongside 13 rectors in 25 years, many of whom set up their own accounts that later had to be untangled. Another described a small parish that struggled for years after their treasurer died, because no one knew the passwords or even where some physical keys were. I'm living my own version of this right now as I set-up a new project’s social media accounts, and try to give multiple people access.

What we kept circling back to is that the problem usually isn't the passwords. It's that the knowledge lives in one person's head or device. So, here's a practical, low-drama way to start getting it out.

1. Make a list of everything that has a login

Before you pick a tool, take inventory. One participant suggested starting with a simple vendor spreadsheet. For each account, note:

• What it is and what it's for (website host, Facebook page, payroll, church management software)

• The login email, and whose inbox it lands in

• Who else has access

• How two-factor authentication works for it, and where the backup codes live

• Billing details: which card it's on and when it renews

• When someone last checked that the entry is still accurate

Notice what's not on that list: the passwords themselves. Those belong in the next step. If your list does include passwords (no judgment, plenty of us are there), keep it somewhere locked down rather than in a shared Google Doc. The same goes for the church credit card number.

2. Move the passwords into a password manager

A password manager is an app that stores your logins in an encrypted vault, so you only have to remember one strong password. Our group was already using a mix: LastPass, KeePass, Apple Passwords, TrueKey, and yes, a physical notebook. Every one of those beats a sticky note. A few things to weigh as you choose:

• Pick one built for sharing. The whole goal is that more than one trusted person can get in. Team plans let you share specific vaults (say, "Communications" or "Finance") without handing over everything.

• Pick one that's actively maintained. A tool that hasn't been meaningfully updated in years is its own kind of risk.

• Ask about nonprofit pricing. Team-focused managers like 1Password and Bitwarden have offered nonprofit discounts, but you usually have to email their sales teams to get them.

• If you go free and local, like KeePass, decide who keeps the vault file and where its backup lives.

While you're moving things over, it's a good moment to retire weak passwords. The Cybersecurity and Infrastructure Security Agency (CISA) recommends passwords of at least 16 characters, a different one for every account, and a password manager so nobody has to remember them all.

3. Make accounts belong to the church, not a person

Many of our stories started with an account set up under someone's personal email. When that person moved on, the account quietly went with them. (The social media page still tied to a volunteer who left in 2019 is practically its own genre.) A few fixes:

• Use role-based email addresses like office@ or communications@ for church accounts, so the login survives staff changes. (There’s a tradeoff here with generic in-boxes and spam and fraud risk.)

• Give every social media account at least two admins. On Facebook and Instagram, that means two trusted people with full control, and never sharing a personal Facebook login. Better still, have the page owned by a Meta business portfolio that more than one person manages.

• Add people, don't share logins. Wherever a platform allows it, give each person their own user account. It's much easier to remove one person later than to change a password the whole staff knows.

4. Plan for two-factor before it locks you out

Two-factor authentication (2FA, sometimes called multifactor authentication or MFA) asks for a second proof that it's really you, like a code texted to your phone. CISA calls it a simple way to prevent a large share of account break-ins, and recommends turning it on wherever you can. It was also the source of a lot of sighing in our group, because the code usually goes to one person's device, making transitions (and vacations!) extra tricky — and that’s when we know whose device they’re going to.

A few ways to make it work for a team:

• Where you can, set up 2FA through an authenticator app (like Google Authenticator) or your password manager, rather than one person's cell number.

• If a platform insists on a phone number, consider a church-owned line instead of a staff member's personal one.

• Every time you turn on 2FA, save the backup or recovery codes in your password manager. They're your way back in when a phone goes missing or a staff member moves on.

5. Write the "hit-by-a-bus" document

An HBB file, short for "hit by a bus," covers far more than logins. (If that name feels a little grim, the internet tells me that some folks call it the "won the lottery" file. Same idea, happier ending.) It answers one question: what would someone need to know to keep things running if you vanished tomorrow?

Things worth including:

• Where the password manager lives and who can get into it

• Building keys, alarm codes, and who to call when the boiler acts up

• Vendor and service contacts

• How routine tasks actually get done: payroll, the bulletin, the newsletter

• Brand basics like website fonts and colors, so the next person isn't guessing

It doesn't have to be pretty. It just has to exist, and someone besides you has to know where it is.

6. Decide who gets access, on purpose

This is where the conversation got a little tender. Who holds the keys can start to feel like a question of trust, or control, between staff and vestry or council.

A few principles that help:

• Give people the access their role needs, not access to everything.

• Make sure at least two people can reach every critical account, and that one of them is in elected leadership.

• Keep a simple offboarding checklist for when staff, clergy, or volunteers step away: remove their access, transfer anything in their name, and change any shared passwords they knew.

7. Put a check-up on the calendar

None of this stays current on its own. Pick a natural moment each year, like right after your annual meeting or when new vestry members are seated, to walk through the account list, remove people who've moved on, and confirm the backup codes still work. An hour once a year beats a frantic week of password resets.

☕A Final Word: Keeping the keys for whoever comes next

It's easy to treat all of this as a chore — and maybe even one we’re not technologically equipped for. But underneath it is something we already know: In church life, we are stewards, not owners. The website, the Facebook page, and the bank login all belong to the community, and they'll outlast any one of us. Writing things down is a way of caring for whoever comes after you.