Short answer: Never share a 2FA code by message. Instead, give every person their own login where the platform supports it, and where it does not — a shared social account, a legacy tool — put the TOTP secret in a shared password manager vault (Bitwarden, 1Password, Proton Pass) so codes generate for whoever needs them, without anyone forwarding digits. Then keep an offboarding checklist, because that is where small teams actually get burned.
The problem every small team hits
You enable 2FA on the company Instagram. Now the code goes to one phone. That person goes on holiday, or is in a meeting, or leaves the company — and the marketing account is inaccessible.
So the team does the obvious thing: a WhatsApp group where someone screenshots the code on request. It works, and it quietly undoes the protection. Codes sit in chat history, on multiple phones, in cloud backups, visible to anyone who later joins the group or compromises any member’s device.
The correct answer is not “share more carefully”. It is to stop sharing codes at all.
Rule 1: Use individual accounts wherever they exist
Before solving code-sharing, check whether you need to share at all. Most serious platforms have proper multi-user access:
- Facebook and Instagram — Meta Business Suite assigns roles to individual accounts. Nobody needs the original password.
- Google Workspace — separate users, admin delegation, shared drives.
- Shopify, Stripe, Xero, Mailchimp — all support team members with distinct logins and permissions.
- WordPress — individual user accounts by role, with 2FA enforced per user. See setting up 2FA on WordPress.
- LinkedIn — Company Page admins are individuals, not a shared login. See our LinkedIn guide.
Individual accounts give you three things a shared login never will: an audit trail of who did what, instant revocation when someone leaves, and no need to change a password every time the team changes.
The rule: shared credentials are a last resort, not a default.
Rule 2: For genuinely shared accounts, share the secret — not the codes
Some accounts have no multi-user support: an old supplier portal, a bank with one login, a legacy tool, certain social platforms.
For these, use a password manager with team or family features and a shared vault:
- Bitwarden — free and paid organisations with collections; TOTP included in paid tiers.
- 1Password — shared vaults with built-in one-time password fields.
- Proton Pass — shared vaults with TOTP.
- Keeper, Dashlane — similar team functionality.
Store the password and the TOTP secret in the same shared item. Everyone with vault access generates their own codes on demand. Nobody screenshots anything, nothing lands in chat history, and revoking someone’s vault access removes their ability to generate codes from that moment.
Set this up at enrolment: when you turn on 2FA for the shared account, paste the setup key into the vault item rather than only scanning it into one phone. See entering a setup key manually, and the trade-offs in password managers with built-in TOTP.
Rule 3: Keep the crown jewels out of the shared vault
Not everything belongs in a shared vault. Keep these under individual control with separate 2FA:
- The company’s primary email and Workspace admin account
- Banking and payment platforms with transfer rights
- The domain registrar and DNS
- Server, hosting and cloud infrastructure root accounts
- The password manager’s own admin account
These should be held by one or two named people, with a documented emergency access process — most password managers offer break-glass emergency access with a time delay. That is a far better answer than a shared password nobody has changed since 2023.
Rule 4: Use phishing-resistant methods for admins
Anyone with administrative access to your money, your domain or your customer data should be using a security key or passkey rather than codes.
The reason: the most effective attack on small businesses is a convincing fake login page — a “your invoice is overdue” email, a “your Meta account will be suspended” notice. A code can be relayed through such a page in real time; a security key cannot, because it refuses to authenticate on the wrong domain. See phishing-resistant MFA and what a hardware security key is.
Buy keys in pairs so a lost one is not an outage.
Rule 5: Have an offboarding checklist
This is where small teams are genuinely exposed, and it has nothing to do with malice — it is simply forgotten. When someone leaves:
- Revoke their password manager vault access first.
- Remove them from Business Suite, Workspace, Slack, and every platform with individual roles.
- Change the passwords on any shared accounts they could access, and re-enrol the 2FA — a TOTP secret they scanned still generates valid codes forever, even after the password changes. Rotating the password without rotating the secret is the most commonly missed step.
- Revoke API keys and tokens they created.
- Sign out all sessions on shared accounts.
- Reclaim any accounts registered in their personal name or email.
Write this down once and follow it every time. Also run it as an audit twice a year, because most teams discover at least one person who still has access to something.
Rule 6: Make the recovery plan explicit
Decide, before you need it, who holds the backup codes for shared accounts and where they live. Options that work: a sealed envelope in a safe, an encrypted file two directors can reach, or an emergency-access contact in the password manager.
Options that do not work: one person’s phone, a note in the shared drive that the drive account itself protects, or a group chat. See where to store backup codes safely and how to back up your authenticator app.
Frequently asked questions
Is sharing a TOTP secret with the team safe?
Safer than sharing codes in chat, and much safer than no 2FA. It is a compromise for accounts with no multi-user support — use individual logins wherever they exist, and re-enrol the secret whenever someone leaves.
Can two people use the same authenticator token at once?
Yes. Any number of devices holding the same secret generate identical codes simultaneously. Nothing conflicts, which is what makes the shared-vault approach work.
What about SMS to a shared company phone?
Poor. It creates a physical bottleneck, and the number is exposed to SIM swapping. See SMS vs authenticator apps.
Should we force 2FA on everyone?
Yes, for anyone with access to customer data, money or publishing rights. Most business tools support enforcement policies with a grace period. Expect confusion rather than objection — provide a one-page guide.
What if someone leaves on bad terms?
Run the full offboarding list immediately, including re-enrolling 2FA on shared accounts. Then check for API tokens and forwarding rules on mailboxes, which are the two things people forget.
Do we need a paid password manager?
For a team, yes — free tiers rarely include shared vaults with TOTP and proper access control. It is among the cheapest security spending available, and it replaces the WhatsApp group entirely.
The bottom line
Individual logins wherever they exist. Shared vault with the TOTP secret where they do not. Security keys for admins. A written offboarding checklist that includes re-enrolling 2FA, not just changing passwords. That combination lets a small team move quickly without a group chat full of six-digit codes.
Start by auditing which accounts genuinely need sharing — usually far fewer than you expect. Then read the 9 most common 2FA mistakes to check you are not making them at scale.