Password Management for Remote Executive Assistants: A Security Guide
Password management for executive assistants
Password management is one of the most underplanned aspects of remote executive support. Many executive-EA relationships start with credentials being shared over email or in a chat message, which creates a security exposure that neither party intended to create. A simple, structured approach to credential management is not difficult to put in place and substantially reduces the risk.
The core principle is that credentials should never be transmitted in plain text. Everything else in this guide builds on that.
Use a dedicated password manager for shared accounts
The standard solution for credential sharing between an executive and their remote assistant is a shared vault within a dedicated password manager. Tools like 1Password, Bitwarden, and LastPass all offer vault-sharing features that allow two people to access shared credentials without either person needing to copy and paste a password into a message.
The executive creates the vault and populates it with the credentials the EA needs. The EA accesses those credentials through their own account, which logs each access. Neither person needs to know what the other's master password is.
This setup also makes credential management clean when the engagement ends. The executive removes the EA's access from the vault, and those credentials are immediately inaccessible. No need to change every password individually.
Categorize what the EA can and cannot access
Not every executive account needs to be in the shared vault. Create a clear list of which credentials the EA needs to do their job and which should remain exclusively with the executive.
Accounts the EA typically needs access to include: the email platform, calendar tool, scheduling software, travel booking portals, and document management systems. Accounts that should generally remain exclusive to the executive include banking and financial accounts, accounts with legal or contractual authority, and any account where the executive's identity is used to sign or authorize.
For a fuller view of how security and discretion work in executive support, the guide on confidentiality and discretion covers the standards that apply more broadly to the handling of sensitive information.
Set up two-factor authentication correctly for shared access
Two-factor authentication (2FA) is essential on high-value accounts, but it creates a practical problem in a shared access context: the one-time code goes to the executive's phone, not the EA's device. If the EA needs to log in and 2FA is required, they have to interrupt the executive to get the code.
The solution for accounts the EA accesses regularly is to use an authenticator app that supports shared access, such as Duo or Authy, which allows a second device to be enrolled. Alternatively, configure a TOTP (time-based one-time password) entry in the shared password manager vault, which generates the 2FA code alongside the stored credentials.
For accounts where shared 2FA would create security concerns, use platform-specific delegation features, such as Gmail delegate access, rather than sharing the login credentials at all.
Document access and review it regularly
Keep a current record of which accounts the EA has access to, through what method, and when access was granted. This documentation does not need to be complex. A shared spreadsheet in the document management system with four columns (account name, access method, date granted, and review date) is enough.
Set a quarterly review of the list. Accounts that the EA no longer needs access to should be removed. Access methods that have become outdated should be updated. This process prevents the slow accumulation of unnecessary access that happens when credentials are shared informally and never audited.
Pair this with the remote EA tech stack overview to see how credential management fits into the broader tool and access structure for remote executive support.
What NIST recommends about credential management
The National Institute of Standards and Technology publishes digital identity guidelines that are the practical standard for credential management in professional environments. The core recommendations, use long unique passwords, avoid reuse across accounts, and never transmit credentials in plain text, apply directly to executive support relationships.
Frequently asked questions
How should a remote EA and executive share passwords?
Through a dedicated password manager with a shared vault. The executive adds credentials to the vault and grants the EA access. Neither party needs to know the other's master password, access is logged, and revoking access when the engagement ends takes seconds.
Which password manager is best for executive-EA credential sharing?
1Password, Bitwarden, and LastPass all support shared vault functionality. 1Password is widely used in professional services environments for its clean interface and strong audit logging. Bitwarden is open-source and available at low cost for small teams. The right choice depends on what the executive already uses and what their IT environment supports.
What should an EA never have access to?
Financial accounts, banking portals, accounts used to legally authorize documents, and any account where the executive's credentials have regulatory or legal significance should remain exclusive to the executive. The EA can coordinate around these accounts without needing direct access.
What happens to shared credentials when the engagement ends?
The executive removes the EA from the shared vault and rotates any passwords for accounts where the EA previously had direct credential access. A clean offboarding checklist that includes credential review prevents accounts from remaining accessible after the engagement has ended.
Is it safe to store 2FA codes in a password manager?
For accounts the EA accesses regularly, storing TOTP codes in the shared vault alongside the credentials is a practical solution. It reduces the friction of requiring the executive to provide a one-time code each time the EA logs in. For the highest-sensitivity accounts, keeping 2FA exclusively on the executive's device is the more secure approach.