How to share 2FA codes with your team

The short answer

Try not to share 2FA at all. In order of preference:

1. Give each person their own access to the shared thing: a delegated or shared mailbox, a team role, an admin seat. Each person then signs in with their own password and their own second factor.
2. Register more than one authenticator on the account, one per person, where the service allows it. AWS, for example, lets a root user or IAM user register up to eight MFA devices.
3. Keep the 2FA secret in a shared password-manager vault, so the people who need the account get the code from the same item as the password, and nobody forwards codes by text.
4. If you must hand a 2FA setup to one person, send it once in an encrypted link that expires, and set up 2FA again when they no longer need access.

Who this is for: IT admins and team leads who manage shared logins: support inboxes, social media and ad accounts, vendor portals, cloud root accounts.

Why is sharing 2FA codes risky?

A six-digit code is the visible part. The part that matters is the secret behind it, usually shown once as a QR code when 2FA is set up. Whoever holds the secret can make valid codes forever, on any device.

• Screenshots of the QR code in chat, email or a ticket are copies of the secret. They stay searchable long after setup.
• Forwarding codes by text or chat trains people to send codes to whoever asks, which is exactly what phishing relies on.
• One phone, one person becomes a single point of failure: when they're on holiday or leave, nobody can sign in.
• Offboarding doesn't remove a secret. Someone who once scanned the QR code can keep generating valid codes until 2FA on the account is set up again with a new secret.

How do authenticator codes actually work?

Most authenticator apps use time-based one-time passwords (TOTP), defined in RFC 6238. The service and the app share a secret. Every 30 seconds by default, both compute a code from that secret and the current time, and the codes match. Two consequences follow:

• The same secret gives the same codes on every device. That's why scanning one QR code into several phones, or into a password manager, works.
• Protecting 2FA means protecting the secret. The codes expire in seconds; the secret doesn't.

The QR code is just the secret in a scannable form. Authenticator apps read a standard otpauth:// address that carries the secret, the account name and the issuer.

What are the ways to give a team 2FA-protected access?

Which option fits your situation?

How do you hand over a 2FA setup securely, step by step?

Sometimes one person sets up 2FA and someone else needs it: a new admin taking over an account, or a single login moving into the team's vault. Hand the secret over once, deliberately:

1. During setup, copy the secret, the text the service shows next to the QR code, or the otpauth:// address if your tool shows it.
2. Create a share. In CredenShare, open Shares and click Create Share. Put the otpauth:// address in a QR code field, so the recipient can scan it with their phone from the share page, and the plain secret in a Password field as a fallback.
3. Keep the title generic, for example "Vendor portal 2FA". Titles and descriptions are stored readable; only the fields are encrypted in your browser.
4. Set one view, a short expiry and a passcode (Solo and above), and send the passcode through a different channel.
5. Confirm it was opened with the access log (paid plans) or an activity email, then ask the recipient to add the secret to their authenticator or the team vault straight away.
6. Delete any other copies: the screenshot on your phone, the note in your clipboard history.

What should you do when someone with the 2FA secret leaves?

1. Set up 2FA on the account again, so the old secret stops working. On most services that means turning two-factor off and on, or "re-enrolling" the authenticator, which issues a new secret.
2. Regenerate backup or recovery codes, if the service has them.
3. Change the password at the same time, and update the vault item.
4. Remove their registered device on services that list several. The contractor and vendor access close-out covers the rest of the checklist.

How do you make sure everyone on the team uses 2FA?

Most identity providers and business tools let an admin require two-factor authentication for every member. In CredenShare, a team owner can require two-factor authentication for everyone in the team (Basic, Plus, Business and Enterprise), with a grace period of up to 14 days. Members without it are reminded during the grace period, then need to turn it on before they can use the team. Owners and admins can see who has it on in the member list. A team API key whose owner hasn't turned it on is refused too.

Summary

• Avoid sharing 2FA: give each person their own access, or register one authenticator per person.
• When one login must be shared, keep the TOTP secret in a shared vault, not on one person's phone.
• Protect the secret, not just the code: no QR screenshots in chat, and hand it over once in an expiring link.
• When someone leaves, set up 2FA again so their copy of the secret stops working.

Related: How to send a password securely · How to share an API key securely · How to share passwords with 1Password · All guides

Sources (checked on November 3, 2026):
IETF RFC 6238: TOTP ·
Google Authenticator: Key URI format ·
AWS: MFA in IAM ·
Microsoft: About shared mailboxes ·
Google: Delegate and collaborate on email ·
1Password: Use 1Password as an authenticator ·
Bitwarden: Integrated authenticator

Product names are trademarks of their respective owners. CredenShare is not affiliated with them.