[{"data":1,"prerenderedAt":385},["ShallowReactive",2],{"globals":3,"cookie-settings":230,"page-guides/share-2fa-codes":263},{"id":4,"title":5,"description":6,"logo_light":7,"logo_dark":7,"address":7,"contact_email":8,"contact_phone":7,"header_menu":9,"footer_menu":10,"favicon":7,"public_url":11,"meta_title":12,"meta_description":13,"robots":14,"head_scripts":15,"body_scripts":16,"default_header":17,"default_footer":196,"social_links":7},1,"CredenShare","Secure credential sharing for modern teams. Encrypted in your browser, with time-limited, access-controlled links.",null,"hello@credenshare.io","fafb0437-6fc7-409e-bcce-a2519eacef43","96f782ae-6d59-4601-abd1-a4fca64cc4de","https://credenshare.io","CredenShare - Secure Credential Sharing","Share passwords, API keys and secrets securely with CredenShare. Encrypted in your browser, time-limited access, and detailed access logs.","# CredenShare Robots.txt\nUser-agent: *\nAllow: /\n\n# Sitemap\nSitemap: https://credenshare.io/sitemap.xml\n\n# Disallow admin paths\nDisallow: /api/\nDisallow: /admin/\nDisallow: /dev/\n\n# Allow main content\nAllow: /blog/\nAllow: /features/\nAllow: /pricing/\nAllow: /security/\nAllow: /docs/\n\n# Crawl-delay\nCrawl-delay: 1\n",[],[],{"id":18,"sort":7,"user_created":19,"date_created":20,"user_updated":19,"date_updated":21,"name":22,"logo":7,"show_cta":23,"cta_label":24,"cta_link":25,"cta_style":26,"sticky":23,"transparent":27,"navigation":28},"d16d4c9e-b3f8-4ea8-988b-eab863efb29c","e7d5f744-1dbd-47ad-9e01-63a9303d109e","2026-02-03T16:36:10.957Z","2026-08-17T22:46:13.371Z","Default Header",true,"Get Started","https://app.credenshare.io/register","primary",false,{"id":9,"sort":7,"user_created":19,"date_created":29,"user_updated":7,"date_updated":7,"title":30,"location":31,"items":32},"2026-02-03T16:36:40.078Z","Main Navigation","main-menu",[33,44,52,56,64,72,80,87,90,97,106,113,118,125,133,138,145,153,161,169,172,180,188],{"id":34,"sort":35,"user_created":19,"date_created":36,"user_updated":19,"date_updated":37,"label":38,"type":39,"url":40,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":42,"description":43,"badge":7},"157a8094-f17f-4348-bd73-774c0573b088",0,"2026-10-04T15:58:24.950Z","2026-10-23T23:13:13.022Z","Guides & Templates","custom","/resources","bf76488c-e318-48a2-8561-c32f76c61383","i-heroicons-document-text","Free practical guides and checklists",{"id":45,"sort":4,"user_created":19,"date_created":46,"user_updated":7,"date_updated":7,"label":47,"type":39,"url":48,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":50,"description":51,"badge":7},"1ee916dd-34a1-41fc-ad80-64681d2440ed","2026-02-11T11:19:14.086Z","Features","/features","0a887c3c-a748-4217-9e34-daf852801d4e","i-heroicons-sparkles","Everything CredenShare offers",{"id":49,"sort":4,"user_created":19,"date_created":53,"user_updated":7,"date_updated":7,"label":54,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:13.606Z","Product","dropdown",{"id":57,"sort":4,"user_created":19,"date_created":58,"user_updated":7,"date_updated":7,"label":59,"type":39,"url":60,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":62,"description":63,"badge":7},"fd3cae1e-592b-413d-91e5-b1258e0aff49","2026-02-11T11:19:16.508Z","Team Onboarding","/solutions/team-onboarding","daee37a1-a164-4b63-be67-1f91e4e9b497","i-heroicons-user-plus","Securely onboard new team members",{"id":65,"sort":4,"user_created":19,"date_created":66,"user_updated":7,"date_updated":7,"label":67,"type":39,"url":68,"parent":41,"post":7,"navigation":9,"target":69,"classes":7,"page":7,"icon":70,"description":71,"badge":7},"0bacbbcf-acfb-4054-94dd-b3388ed7f576","2026-10-23T23:13:21.028Z","Compare","/compare","_self","i-heroicons-scale","Password managers and sharing tools compared",{"id":73,"sort":74,"user_created":19,"date_created":75,"user_updated":7,"date_updated":7,"label":76,"type":39,"url":77,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":78,"description":79,"badge":7},"63e46db0-4bed-4f24-b7bd-a79e821f3d89",2,"2026-02-11T11:19:16.976Z","Third-Party Access","/solutions/third-party-access","i-heroicons-users","Safe contractor credentials",{"id":81,"sort":74,"user_created":19,"date_created":82,"user_updated":7,"date_updated":7,"label":83,"type":39,"url":84,"parent":41,"post":7,"navigation":9,"target":69,"classes":7,"page":7,"icon":85,"description":86,"badge":7},"704e9cab-d404-4b7a-b5c1-d8d66aa45862","2026-10-23T23:13:21.131Z","How-to Guides","/guides","i-heroicons-light-bulb","Share passwords and secrets safely",{"id":61,"sort":74,"user_created":19,"date_created":88,"user_updated":7,"date_updated":7,"label":89,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:16.058Z","Solutions",{"id":91,"sort":74,"user_created":19,"date_created":92,"user_updated":7,"date_updated":7,"label":93,"type":39,"url":94,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":95,"description":96,"badge":7},"6eb63ded-6ac9-4595-a55f-8795b193fe04","2026-02-11T11:19:14.648Z","How It Works","/how-it-works","i-heroicons-play-circle","See CredenShare in action",{"id":98,"sort":99,"user_created":19,"date_created":100,"user_updated":19,"date_updated":101,"label":102,"type":39,"url":103,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":104,"description":105,"badge":7},"8a9a4df2-3f19-4897-948a-a4d520b9389b",3,"2026-02-11T11:19:20.202Z","2026-10-23T23:13:13.401Z","Documentation","https://docs.credenshare.io","i-heroicons-book-open","Guides and API reference",{"id":107,"sort":99,"user_created":19,"date_created":108,"user_updated":7,"date_updated":7,"label":109,"type":39,"url":110,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":111,"description":112,"badge":7},"1cf2f869-1bb4-447a-b9d7-738b45995379","2026-02-11T11:19:17.466Z","Credential Collection","/solutions/secure-requests","i-heroicons-inbox-arrow-down","Request credentials securely",{"id":114,"sort":99,"user_created":19,"date_created":115,"user_updated":7,"date_updated":7,"label":116,"type":39,"url":117,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"790829b5-6e85-45a2-b729-01a224f1c816","2026-02-11T11:19:18.867Z","Pricing","/pricing",{"id":119,"sort":99,"user_created":19,"date_created":120,"user_updated":7,"date_updated":7,"label":121,"type":39,"url":122,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":123,"description":124,"badge":7},"5c9151ac-94e1-4d54-8032-768568b9ad02","2026-02-11T11:19:15.116Z","Security","/security","i-heroicons-shield-check","Our security architecture",{"id":126,"sort":127,"user_created":19,"date_created":128,"user_updated":7,"date_updated":7,"label":129,"type":39,"url":130,"parent":49,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":131,"description":132,"badge":7},"d7882f47-9f94-4860-93df-0025ff5ac8bc",4,"2026-02-11T11:19:15.577Z","Integrations","/integrations","i-heroicons-puzzle-piece","Slack, API, and more",{"id":134,"sort":127,"user_created":19,"date_created":135,"user_updated":7,"date_updated":7,"label":136,"type":39,"url":137,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"e696e64d-65e1-4b67-aef9-60db78b9f4cf","2026-02-11T11:19:19.313Z","Blog","/blog",{"id":139,"sort":127,"user_created":19,"date_created":140,"user_updated":7,"date_updated":7,"label":141,"type":39,"url":142,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":143,"description":144,"badge":7},"2ac2df39-fbae-45a2-b87a-313bebb4a87b","2026-02-11T11:19:17.957Z","Development Teams","/solutions/development-teams","i-heroicons-code-bracket-square","Secure credentials for dev workflows",{"id":146,"sort":127,"user_created":19,"date_created":147,"user_updated":19,"date_updated":148,"label":149,"type":39,"url":150,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":151,"description":152,"badge":7},"719ce073-d71f-4450-b45a-f08a05db21b2","2026-02-11T11:19:20.640Z","2026-10-23T23:13:13.301Z","About","/about","i-heroicons-information-circle","Our mission and team",{"id":154,"sort":155,"user_created":19,"date_created":156,"user_updated":7,"date_updated":7,"label":157,"type":39,"url":158,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":159,"description":160,"badge":7},"e18246ff-9a00-449a-88f8-09490a3cead2",5,"2026-08-24T23:17:28.605Z","Vendor Access","/solutions/vendor-access","i-heroicons-building-office-2","Share credentials with outside vendors",{"id":162,"sort":155,"user_created":19,"date_created":163,"user_updated":19,"date_updated":164,"label":165,"type":39,"url":166,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":167,"description":168,"badge":7},"567bc13d-4499-4dc5-a346-5eba54c1c500","2026-02-11T11:19:21.085Z","2026-10-23T23:13:13.212Z","Tools","/tools","i-heroicons-wrench-screwdriver","Free security & developer tools",{"id":41,"sort":155,"user_created":19,"date_created":170,"user_updated":7,"date_updated":7,"label":171,"type":55,"url":7,"parent":7,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"2026-02-11T11:19:19.768Z","Resources",{"id":173,"sort":174,"user_created":19,"date_created":175,"user_updated":7,"date_updated":7,"label":176,"type":39,"url":177,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":178,"description":179,"badge":7},"99bda669-3c3a-4521-815b-a1eb22a4098e",6,"2026-08-24T23:17:28.791Z","AI Agents","/solutions/ai-agents","i-heroicons-cpu-chip","Give agents scoped, expiring credentials",{"id":181,"sort":174,"user_created":19,"date_created":182,"user_updated":19,"date_updated":183,"label":184,"type":39,"url":185,"parent":41,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":186,"description":187,"badge":7},"1f787a64-8e12-484d-ae97-b6349bc82e52","2026-02-11T11:19:21.524Z","2026-10-23T23:13:13.121Z","Pastebin","https://paste.credenshare.io","i-heroicons-clipboard-document","Secure encrypted pastebin",{"id":189,"sort":190,"user_created":19,"date_created":191,"user_updated":19,"date_updated":192,"label":193,"type":39,"url":194,"parent":61,"post":7,"navigation":9,"target":7,"classes":7,"page":7,"icon":159,"description":195,"badge":7},"1f06247b-4633-4341-a388-95ffa524a27a",7,"2026-02-11T11:19:18.416Z","2026-08-24T23:17:03.952Z","Enterprise","/enterprise","Compliance and audit-ready security",{"id":197,"sort":7,"user_created":19,"date_created":198,"user_updated":19,"date_updated":199,"name":200,"logo":7,"tagline":201,"show_social":23,"copyright_text":202,"show_newsletter":23,"newsletter_heading":203,"newsletter_description":204,"navigation_columns":205,"bottom_links":206},"355d9ac1-c909-4cda-9071-cd3abb00a0b5","2026-02-03T16:36:11.825Z","2026-11-02T14:01:12.933Z","Default Footer","Secure credential sharing for modern teams.","© {year} CredenShare Inc. All Rights Reserved.","Stay updated","Credential incidents explained and practical guides, every two weeks. Unsubscribe any time.",[],{"id":207,"sort":7,"user_created":19,"date_created":208,"user_updated":7,"date_updated":7,"title":209,"location":210,"items":211},"861b9a44-206d-4778-9251-f5269206fdf9","2026-02-03T16:36:41.786Z","Legal Links","legal-menu",[212,218,224],{"id":213,"sort":4,"user_created":19,"date_created":214,"user_updated":19,"date_updated":215,"label":216,"type":39,"url":217,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"3e16a067-ce9f-4e4d-aea6-7a602094f9df","2026-02-03T16:37:32.902Z","2026-08-25T00:24:57.325Z","Terms of Service","/legal/terms",{"id":219,"sort":74,"user_created":19,"date_created":220,"user_updated":19,"date_updated":221,"label":222,"type":39,"url":223,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"6e9bc58b-b6d0-46f8-8c7b-123ea3273f5b","2026-02-03T16:37:32.360Z","2026-08-25T00:24:57.850Z","Privacy Policy","/legal/privacy",{"id":225,"sort":99,"user_created":19,"date_created":226,"user_updated":19,"date_updated":227,"label":228,"type":39,"url":229,"parent":7,"post":7,"navigation":207,"target":7,"classes":7,"page":7,"icon":7,"description":7,"badge":7},"78a410a6-802d-4920-a915-d8e5d2155f0c","2026-02-03T16:37:33.462Z","2026-08-25T00:24:59.086Z","Cookie Policy","/legal/cookies",{"enabled":23,"banner_position":231,"banner_title":232,"banner_text":233,"accept_all_text":234,"decline_all_text":235,"preferences_text":236,"save_preferences_text":237,"policy_page":238,"privacy_page":240,"categories":242,"id":4},"bottom","We value your privacy","We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking \"Accept All\", you consent to our use of cookies.","Accept All","Decline All","Manage Preferences","Save Preferences",{"slug":239},"legal/cookies",{"slug":241},"legal/privacy",[243,248,253,258],{"id":244,"name":245,"key":246,"description":247,"required":23,"default_enabled":23},"1","Essential","essential","Required for the website to function. Cannot be disabled.",{"id":249,"name":250,"key":251,"description":252,"required":27,"default_enabled":27},"2","Analytics","analytics","Help us understand how visitors interact with our website.",{"id":254,"name":255,"key":256,"description":257,"required":27,"default_enabled":27},"3","Marketing","marketing","Used to deliver relevant advertisements and track campaign performance.",{"id":259,"name":260,"key":261,"description":262,"required":27,"default_enabled":27},"4","Preferences","preferences","Remember your settings and preferences for a better experience.",{"id":264,"status":265,"sort":7,"user_created":19,"date_created":266,"user_updated":19,"date_updated":267,"title":268,"slug":269,"seo":270,"revision":7,"user_published":7,"date_published":278,"blocks":279,"featured_image":7,"header_override":7,"footer_override":7},"c0ece647-6cca-4c93-89ae-65fcacca0835","published","2026-11-03T13:55:42.257Z","2026-11-09T14:01:39.746Z","How to share 2FA codes with your team","guides/share-2fa-codes",{"title":271,"meta_description":272,"no_index":27,"no_follow":27,"og_title":273,"og_description":273,"og_image":7,"sitemap_change_frequency":274,"sitemap_priority":275,"additional_fields":276},"How to share 2FA codes with your team (without the risk)","Give each person their own access first; share a 2FA secret only when you must. Delegation, extra MFA devices, shared vaults and a safe one-time handoff.","","monthly",0.6,{"canonical_url":277},"https://credenshare.io/guides/share-2fa-codes","2026-11-09T14:01:39.747Z",[280,299,306,319,362],{"id":281,"collection":282,"item":283},1174,"block_hero",{"id":284,"sort":7,"user_created":19,"date_created":285,"user_updated":7,"date_updated":7,"headline":268,"subheadline":286,"background_type":7,"background_color":7,"background_image":7,"background_video":7,"gradient_start":7,"gradient_end":7,"gradient_direction":7,"overlay_color":7,"overlay_opacity":7,"height":7,"content_width":7,"text_alignment":287,"vertical_alignment":7,"text_color":7,"buttons":288,"style":7},"2620e147-5ad7-4589-9cf6-e4bbdb73ad55","2026-11-03T13:55:42.310Z","Shared accounts and two-factor authentication pull in opposite directions. Here is how to keep the second factor and still let the right people in: per-person access where you can, a shared vault where you can't, and a safe way to hand over the setup code when you have to.","center",[289,294],{"id":290,"sort":4,"user_created":19,"date_created":291,"user_updated":7,"date_updated":7,"hero_id":284,"label":292,"url":293,"style":26,"size":7,"icon":7,"icon_position":7,"open_new_tab":7},"495ae5d9-548d-47a2-82bb-5681766c8a9e","2026-11-03T13:55:42.325Z","Start free","https://app.credenshare.io/register?utm_source=credenshare.io&utm_medium=guide&utm_campaign=share-2fa-codes",{"id":295,"sort":74,"user_created":19,"date_created":296,"user_updated":7,"date_updated":7,"hero_id":284,"label":297,"url":84,"style":298,"size":7,"icon":7,"icon_position":7,"open_new_tab":7},"e7bcbd69-912a-499b-a455-fef39342fa59","2026-11-03T13:55:42.352Z","All guides","outline",{"id":300,"collection":301,"item":302},1175,"block_markdown",{"id":303,"sort":7,"user_created":19,"date_created":304,"user_updated":7,"date_updated":7,"content":305},"b9c6bb83-d0fd-483a-aecb-d1f74e6fd3ab","2026-11-03T13:55:42.406Z","## The short answer\n\n**Try not to share 2FA at all.** In order of preference:\n\n1. **Give each person their own access** to the shared thing: a delegated or shared mailbox, a team role, an admin seat. Each person then signs in with their own password and their own second factor.\n2. **Register more than one authenticator** on the account, one per person, where the service allows it. AWS, for example, lets a root user or IAM user register up to eight MFA devices.\n3. **Keep the 2FA secret in a shared password-manager vault**, so the people who need the account get the code from the same item as the password, and nobody forwards codes by text.\n4. **If you must hand a 2FA setup to one person**, send it once in an encrypted link that expires, and set up 2FA again when they no longer need access.\n\n**Who this is for:** IT admins and team leads who manage shared logins: support inboxes, social media and ad accounts, vendor portals, cloud root accounts.\n\n## Why is sharing 2FA codes risky?\n\nA six-digit code is the visible part. The part that matters is the **secret** behind it, usually shown once as a QR code when 2FA is set up. Whoever holds the secret can make valid codes forever, on any device.\n\n- **Screenshots of the QR code** in chat, email or a ticket are copies of the secret. They stay searchable long after setup.\n- **Forwarding codes by text or chat** trains people to send codes to whoever asks, which is exactly what phishing relies on.\n- **One phone, one person** becomes a single point of failure: when they're on holiday or leave, nobody can sign in.\n- **Offboarding doesn't remove a secret.** Someone who once scanned the QR code can keep generating valid codes until 2FA on the account is set up again with a new secret.\n\n## How do authenticator codes actually work?\n\nMost authenticator apps use time-based one-time passwords (TOTP), defined in RFC 6238. The service and the app share a secret. Every 30 seconds by default, both compute a code from that secret and the current time, and the codes match. Two consequences follow:\n\n- **The same secret gives the same codes on every device.** That's why scanning one QR code into several phones, or into a password manager, works.\n- **Protecting 2FA means protecting the secret.** The codes expire in seconds; the secret doesn't.\n\nThe QR code is just the secret in a scannable form. Authenticator apps read a standard `otpauth://` address that carries the secret, the account name and the issuer.\n\n## What are the ways to give a team 2FA-protected access?\n\n| Option | Good for | What to watch |\n|---|---|---|\n| **Per-person access** (delegation, shared mailboxes, team roles) | Shared inboxes, admin consoles, most business SaaS | Needs a plan or setup that supports it; it's the only option where everyone keeps their own second factor |\n| **Several authenticators on one account** | Cloud root accounts, critical admin logins | Each device must be registered and labelled; remove one when its owner leaves |\n| **Shared password-manager vault with the TOTP secret** (for example 1Password, Bitwarden) | A single login the service won't split: a vendor portal, a social media account | Everyone with the vault can sign in; Bitwarden's built-in codes need Premium or a paid organization |\n| **One person holds the phone and reads codes out** | Nothing | A single point of failure, and it normalises asking for codes |\n| **Forwarding SMS codes** | Nothing | Codes travel through chat; phone-number takeovers bypass it |\n\n## Which option fits your situation?\n\n| Situation | What to use |\n|---|---|\n| A shared support or sales inbox | A **shared mailbox** in Microsoft 365, or **Gmail delegation** in Google Workspace. Microsoft says a shared mailbox's own account should stay blocked from signing in; people use their own accounts. Gmail lets a work account add up to 1,000 delegates. |\n| A cloud provider's root account | **One MFA device per administrator**, registered on the account (AWS allows up to eight), plus a documented break-glass procedure |\n| A social media or ad account | The platform's **team or business roles** first; if it only allows one login, keep the TOTP secret in a **shared vault** |\n| A vendor portal with a single login | **Shared vault** item holding the username, password and TOTP secret |\n| A contractor who needs temporary access | **Their own account** if the service allows it; otherwise the shared vault for the duration, then a new 2FA setup when they leave |\n\n## How do you hand over a 2FA setup securely, step by step?\n\nSometimes one person sets up 2FA and someone else needs it: a new admin taking over an account, or a single login moving into the team's vault. Hand the secret over once, deliberately:\n\n1. **During setup, copy the secret**, the text the service shows next to the QR code, or the `otpauth://` address if your tool shows it.\n2. **Create a share.** In CredenShare, open **Shares** and click **Create Share**. Put the `otpauth://` address in a **QR code** field, so the recipient can scan it with their phone from the share page, and the plain secret in a **Password** field as a fallback.\n3. **Keep the title generic**, for example \"Vendor portal 2FA\". Titles and descriptions are stored readable; only the fields are encrypted in your browser.\n4. **Set one view, a short expiry and a passcode** (Solo and above), and send the passcode through a different channel.\n5. **Confirm it was opened** with the access log (paid plans) or an activity email, then ask the recipient to add the secret to their authenticator or the team vault straight away.\n6. **Delete any other copies:** the screenshot on your phone, the note in your clipboard history.\n\n## What should you do when someone with the 2FA secret leaves?\n\n1. **Set up 2FA on the account again**, so the old secret stops working. On most services that means turning two-factor off and on, or \"re-enrolling\" the authenticator, which issues a new secret.\n2. **Regenerate backup or recovery codes**, if the service has them.\n3. **Change the password** at the same time, and update the vault item.\n4. **Remove their registered device** on services that list several. The [contractor and vendor access close-out](/resources/contractor-access-closeout) covers the rest of the checklist.\n\n## How do you make sure everyone on the team uses 2FA?\n\nMost identity providers and business tools let an admin require two-factor authentication for every member. In CredenShare, a team owner can **require two-factor authentication** for everyone in the team (Basic, Plus, Business and Enterprise), with a grace period of up to 14 days. Members without it are reminded during the grace period, then need to turn it on before they can use the team. Owners and admins can see who has it on in the member list. A team API key whose owner hasn't turned it on is refused too.\n\n## Summary\n\n- **Avoid sharing 2FA**: give each person their own access, or register one authenticator per person.\n- When one login must be shared, keep the **TOTP secret in a shared vault**, not on one person's phone.\n- **Protect the secret, not just the code**: no QR screenshots in chat, and hand it over once in an expiring link.\n- When someone leaves, **set up 2FA again** so their copy of the secret stops working.\n\n**Related:** [How to send a password securely](/guides/send-a-password-securely) · [How to share an API key securely](/guides/share-an-api-key) · [How to share passwords with 1Password](/guides/share-passwords-with-1password) · [All guides](/guides)\n\n---\n\n**Sources** (checked on November 3, 2026):\n[IETF RFC 6238: TOTP](https://www.rfc-editor.org/rfc/rfc6238) ·\n[Google Authenticator: Key URI format](https://github.com/google/google-authenticator/wiki/Key-Uri-Format) ·\n[AWS: MFA in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html) ·\n[Microsoft: About shared mailboxes](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes) ·\n[Google: Delegate and collaborate on email](https://support.google.com/mail/answer/138350) ·\n[1Password: Use 1Password as an authenticator](https://support.1password.com/one-time-passwords/) ·\n[Bitwarden: Integrated authenticator](https://bitwarden.com/help/integrated-authenticator/)\n\n*Product names are trademarks of their respective owners. CredenShare is not affiliated with them.*",{"id":307,"collection":308,"item":309},1176,"block_newsletter",{"id":310,"sort":7,"user_created":19,"date_created":311,"user_updated":7,"date_updated":7,"headline":312,"description":313,"placeholder_text":314,"button_text":315,"button_style":26,"form_action":7,"success_message":316,"error_message":317,"layout":318,"show_name_field":7,"background_color":7,"text_color":7,"style":7},"f6871ccb-2f9e-46ae-9ea4-f8da9c370028","2026-11-03T13:55:42.432Z","Get the next guide in your inbox","Every two weeks: one credential incident explained, three things worth knowing, and the practical steps from our latest guides. Unsubscribe any time.","Your work email","Subscribe","Almost there: check your inbox for a confirmation link.","Something went wrong. Please try again.","card",{"id":320,"collection":321,"item":322},1177,"block_accordion",{"id":323,"sort":7,"user_created":19,"date_created":324,"user_updated":7,"date_updated":7,"headline":325,"allow_multiple":23,"default_open_index":7,"items":326,"style":7},"526dcb8b-0dd8-40d9-8d8b-ce6aace94986","2026-11-03T13:55:42.460Z","Frequently asked questions",[327,332,337,342,347,352,357],{"id":328,"sort":4,"user_created":19,"date_created":329,"user_updated":7,"date_updated":7,"accordion_id":323,"title":330,"content":331},"b8c16a5d-78e2-4236-ae6d-9f92fa36f234","2026-11-03T13:55:42.475Z","Can two people use the same 2FA code?","Yes, if both have the same secret: every authenticator with that secret produces the same codes. Where the service allows it, it is safer to register a separate authenticator for each person.",{"id":333,"sort":74,"user_created":19,"date_created":334,"user_updated":7,"date_updated":7,"accordion_id":323,"title":335,"content":336},"fe16e744-7823-4eee-8d4e-523c6dafbe5c","2026-11-03T13:55:42.483Z","How do I share a 2FA code with my team?","Prefer giving each person their own access. If one login has to be shared, store its TOTP secret in a shared password-manager vault so team members get the code from the same item as the password.",{"id":338,"sort":99,"user_created":19,"date_created":339,"user_updated":7,"date_updated":7,"accordion_id":323,"title":340,"content":341},"464c92ce-edf0-4350-be3b-a21216462660","2026-11-03T13:55:42.490Z","Is it safe to send a 2FA QR code by email or Slack?","No. The QR code contains the secret, so a screenshot in email or chat lets anyone who finds it generate valid codes. Send it once in an encrypted, expiring link, then set up 2FA again if you lose track of who has it.",{"id":343,"sort":127,"user_created":19,"date_created":344,"user_updated":7,"date_updated":7,"accordion_id":323,"title":345,"content":346},"6b50363c-c290-4196-b6a2-18697ddbb891","2026-11-03T13:55:42.498Z","Can I use the same authenticator on two phones?","Yes. Scanning the same QR code on both phones gives both the same codes. Some services also let you register a second, separate authenticator, which is easier to remove later.",{"id":348,"sort":155,"user_created":19,"date_created":349,"user_updated":7,"date_updated":7,"accordion_id":323,"title":350,"content":351},"516dd33a-785c-476c-b49f-75b22bd3f8b2","2026-11-03T13:55:42.505Z","What happens to 2FA when an employee leaves?","If they had the secret, they can still generate valid codes. Set up 2FA on the account again to issue a new secret, regenerate backup codes, and change the password.",{"id":353,"sort":174,"user_created":19,"date_created":354,"user_updated":7,"date_updated":7,"accordion_id":323,"title":355,"content":356},"c001e33e-1bda-4a2f-90a6-d23707b5a814","2026-11-03T13:55:42.513Z","Should shared accounts have two-factor authentication?","Yes. Sharing the secret through a vault, or giving each person their own access, keeps the second factor without one person's phone becoming the only way in.",{"id":358,"sort":190,"user_created":19,"date_created":359,"user_updated":7,"date_updated":7,"accordion_id":323,"title":360,"content":361},"64b8a613-42eb-475c-a662-fe7655fd683d","2026-11-03T13:55:42.522Z","How do I require 2FA for my whole team?","Use your identity provider or each tool's admin settings. In CredenShare, a team owner can require two-factor authentication for every member, with a grace period of up to 14 days.",{"id":363,"collection":364,"item":365},1178,"block_cta",{"id":366,"sort":7,"user_created":19,"date_created":367,"user_updated":7,"date_updated":7,"headline":368,"description":369,"alignment":287,"layout":370,"background_type":371,"background_color":7,"background_image":7,"gradient_start":372,"gradient_end":373,"gradient_direction":374,"text_color":7,"buttons":375,"style":7},"a6dd0b1c-832c-49c2-ad53-6339e216b43b","2026-11-03T13:55:42.555Z","Hand over a 2FA setup once, in a link that expires","Free plan: 3 shares a day, encrypted in your browser. Or use SecurePaste with no account.","stacked","gradient","#4c1d95","#7c3aed","to-right",[376,381],{"id":377,"sort":4,"user_created":19,"date_created":378,"user_updated":7,"date_updated":7,"cta_id":366,"label":379,"url":293,"variant":380,"size":7,"icon":7,"open_new_tab":7},"1b6cd261-c594-45b2-8757-ad45543e5ca0","2026-11-03T13:55:42.565Z","Get started free","solid",{"id":382,"sort":74,"user_created":19,"date_created":383,"user_updated":7,"date_updated":7,"cta_id":366,"label":384,"url":185,"variant":298,"size":7,"icon":7,"open_new_tab":7},"5f92a04c-f6a4-4fa9-a346-80cf29943187","2026-11-03T13:55:42.574Z","Try SecurePaste, no account",1794237319224]