FREELANCER ACCESS
Keep client access separate from your personal vault.
The hard part of freelance access is ownership, not storage. A password manager helps only after you and the client agree who owns each account and what happens when the work ends.
START WITH THE SETUP
Agree who owns each account
- 01
List personal, business, and client accounts in separate groups before you import anything.
- 02
Ask the client to create and own client accounts wherever that is practical.
- 03
Write down which people may receive access, for what task, and for how long.
- 04
Check the client’s existing security policy before choosing a personal tool for shared work.
- 05
Ask which password manager the client already pays for, and whether you can be a guest or a second user in it rather than starting a plan of your own.
WORK THROUGH THE CHANGE
Plan the handover when you grant access
- 1
Ask for an individual invitation to the client’s service where it supports separate users. Use the client’s approved vault or collection when a shared credential is necessary.
- 2
If you only need one client vault, ask about guest access. 1Password Families includes 5 guests, and a guest has no private vault and can be in a single vault at a time; a Bitwarden free organization holds 2 users and up to two collections, which covers one client relationship.
- 3
Keep personal credentials out of client collections and client credentials out of personal shared vaults. Bitwarden items in a collection belong to the organization, not to you, so anything you put there stays with the client.
- 4
When a one-off credential has to move, use a link that expires rather than a message that does not. Bitwarden Send carries text or a file through a temporary link with an expiry date, a maximum access count, and a 31-day maximum life; 1Password can share a copy of an item with an expiry and, if you want, only to named email addresses; Proton Pass paid plans share a single item or a secure link with someone who does not use Proton Pass; NordPass sets a permission and expiry per recipient, but both accounts must be in the same data centre.
- 5
Record the service owner, access granted, and planned removal date when the project starts. Do not put passwords or recovery codes in that record.
- 6
At handover, have the service owner remove your service account or role, review active sessions and tokens, and change any shared credentials that must no longer work for you.
- 7
Remove vault access as a separate step, and check it vault by vault. Proton says a user removed from a Pass Family plan still has access to any shared vaults they are a member of, so each one has to be revoked through Manage access.
- 8
Ask the client to confirm that their remaining administrators can still sign in and recover the account, and that you are not the only person who can.
PUT IT INTO PRACTICE
A handover record without the passwords
Example: a freelancer maintaining a client’s website. Keep the real record in the client’s approved system, not on this page.
- Website editor
- Client owns the site; freelancer has a named editor account. At handover, the client removes that account or role and reviews its sessions.
- Shared hosting login
- Client owns the account and recovery email. At handover, change the shared password, review sessions and tokens, then update the client’s vault entry.
- Confirmation
- Record who completed each removal and when, plus any unresolved access. Do not mark handover complete merely because a shared vault disappeared.
WHAT THE PROVIDERS DOCUMENT
What each provider documents about leaving
Provider documentation, checked on the date shown below. Before a client project starts, confirm who can remove access at handover.
- Bitwarden
- Removing a member ends their access to the organization and its data but does not delete their account, and they keep their personally owned items. Bitwarden says offline devices cache a read-only copy including organization items, and some clients may keep it for a short time after removal; its guidance is to update the credentials the member had access to if misuse is a concern. Administrator account recovery is an Enterprise feature, so on a free organization or a Families plan nobody can reset another member’s master password.
- 1Password
- A removed member loses access to all shared items, including those in the Shared vault, immediately, and other members keep theirs. They have 30 days to sign in on 1Password.com and migrate their personal items; anything not shared with other members is permanently deleted after that. A guest can be removed from one vault and added to a different one instead.
- Proton Pass
- A removed user is downgraded to Pass Free and keeps the passwords in their private and shared vaults. Proton says they will still have access to any shared vaults they are a member of, so ending plan membership is not the same as ending vault access—revoke each vault through Manage access.
- NordPass
- Sharing has five levels—Owner, Can edit, Can share, Can view, Can autofill—and you can set an expiry time per recipient, which is the closest documented match to a fixed-term engagement. Re-sharing is capped at your own level. NordPass does not publish what happens to a member removed from a Family plan; check before you rely on it.
Removing vault access is not the whole handover.
Bitwarden documents that offline clients may retain cached organisation items after removal. Its guidance is to update credentials if misuse is a concern. Our practical recommendation: agree the service-level removal and shared-password changes with the client, not just the vault removal.
Read Bitwarden’s removal guidance; source checked September 22, 2026.
A GOOD REASON TO WAIT
Stop and clarify when
- A client asks you to use a personal login for a business-critical service.
- You cannot tell who owns an account or who should receive its recovery messages.
- The only way to hand work over is to export a copy of credentials for yourself.
- You are the only person who could recover the client’s password manager.
When to use the provider’s instructions
This is a planning guide, not security, legal, or account-recovery advice. Use the provider’s current documentation and your organisation’s policy where they apply.
YOUR NEXT STEP
Decide what you need to manage yourself.
If the client supplies the required system, you may not need another paid plan for that project. Use the checklist for your own devices and business accounts; it does not assess team administration or compliance.