How to collect website logins from clients securely
Last updated · by Cody Johnston
How do you collect website logins from clients securely?
The safest way is delegated access: ask the client to add you as a user on their registrar, host, Google Analytics, Search Console and Business Profile. If a password is unavoidable, share it through a password manager or an encrypted secure note, never plain email, and have the client change it after launch.
Domain, hosting, Google Business Profile, analytics, the old CMS: you need access, and clients tend to email passwords. Here are safer options, best first.
1. Delegated access (best)
Ask the client to invite you as a user. Google Analytics, Search Console, Google Business Profile, most hosts, many registrars and most website builders support adding a collaborator. The client keeps ownership, and access can be removed later.
2. A password manager share
If the client already uses one, a shared item or one-time share link is better than email.
3. An encrypted secure-note field
Tools such as BriefLasso store login notes encrypted rather than sending them through email. Ask the client to change the password after launch.
What to avoid
- Passwords in plain email or text messages.
- Logging in as the client to an account tied to their personal email recovery.
- Keeping logins after the project ends. Delete them and tell the client.
Logins are one section of a full website content checklist.
Frequently asked questions
Should a client give me their domain registrar password?
Prefer delegated access or having the client make DNS changes on a call. If you must use the password, share it through a password manager and have them change it afterwards.
Written by Cody Johnston, maker of BriefLasso. Last updated October 12, 2026.