Shared passwords in hotels: a routine for extranets, Wi-Fi and social accounts

A hotel needs a written owner and a backup person for every shared login, a password manager that stores the secrets, and a tested recovery route for each account. A password manager for hotels is simply software that keeps logins in one encrypted vault; one person holds the master key and a sealed copy sits offline.

The general manager is on a plane, the marketing person who set up the Instagram page left in March, and the booking extranet is asking for a code that goes to a phone nobody in the building is holding. Nothing is broken yet, and everything is stuck. After reading this you will know which accounts cannot belong to one person, how to record them, who holds the master key, what changes the day someone leaves, and how to get back in when the only person who knew has gone.

Which hotel accounts cannot belong to one person?#

Any account the hotel must keep working after an individual leaves cannot belong to that individual. In practice the list is short and predictable: the domain, the website, the Google or Microsoft profile, social media, the guest Wi-Fi and router admin, device admin panels, and some extranets.

Start by separating role accounts from personal ones. A mailbox like info@ or rezervasyon@ belongs to the hotel and outlives the person; a named person's own mailbox does not. The same logic applies to every account on the list above.

The domain registrar and its DNS settings are the most damaging thing to lose, because mail, the website and often the booking engine hang from them. Hotel website security and ownership: domain, certificate, updates and logins covers that layer in detail.

Some extranets allow a separate sub-user for each staff member, so use that and nobody shares anything. Others issue one login per property, and that login is a shared secret whether the hotel admits it or not.

Device admin panels are the quiet ones: router and firewall, door-lock system, TV or IPTV head end, POS back office. They are rarely opened, so nobody notices the password is only in one head.

The decision rule is simple: if two people could need it in the same week, it is a shared account and needs an owner, a backup and a recovery route. Inside the hotel's own management system the opposite rule applies: shared logins should not exist at all, and each person should have their own user. PMS user roles and permissions: a setup checklist for hotels explains that setup.

The account register: what to write down for each login#

Write one row per account with seven fields, and the register becomes the thing you hand over, review and recover from. It holds no passwords, only the map to them.

The owner field is a role plus a name: write "front office manager, currently X", so the row still makes sense after the next change. The recovery phone should be a number the hotel controls, not the owner's personal mobile, and the recovery email should be a role mailbox, never a personal address.

Record where the secret lives (which vault folder, or which sealed envelope) rather than the secret itself, so the register can be shared more widely than the vault. Keep it where two people can reach it without asking a third, and keep a printed copy with the emergency material. Review it twice a year and after every departure, not only when something breaks. Start with the accounts whose loss would stop the hotel this week; the rest can follow.

Cells hold roles and locations, never passwords.

What is a password manager, and who holds the master key?#

A password manager is software that keeps logins in one encrypted vault. People open the vault with a single strong password and it fills the rest, so the hotel stops relying on memory and on the same three passwords everywhere.

The mechanism that matters is per-person access to a shared vault: each staff member has their own vault login, so removing a person removes their access without changing every password in the building. Use a shared folder inside the vault for the accounts on the register, and keep personal vaults for personal logins.

The master key is the hotel's, not the IT contact's. At least two people must be able to open the vault, and both should know that openings are recorded. Print the emergency kit once, seal it, and store a second copy off site. A vault protected only by one person's phone is not a vault, it is a hostage situation.

A browser's saved passwords are not a shared vault: they live in one browser profile on one device and disappear with it. Choose the tool by whether it supports shared folders, per-person access and an export you can read, not by its feature list. For the wider picture of what else deserves attention, see the hotel cybersecurity checklist for owners and general managers.

Two-step codes: whose phone, and what happens in August?#

Every shared account with two-step verification needs a phone number the hotel controls and a second person who can receive the code. Otherwise the account stops on the day the owner goes on holiday.

Two-step verification means a second proof beyond the password: a code by text message, a code from an authenticator app, or a physical security key. Prefer an authenticator app or a security key where the account allows it; a text message depends on one SIM card in one handset.

Treat the SIM as an asset: a hotel-owned number registered to the hotel, with the default PIN changed. Print the recovery codes once and store them with the master key; they bypass the phone entirely and are as sensitive as the password. Name a backup who can receive codes, and test it before the holiday, not during it.

Never forward a code by message to a colleague. That is the exact pattern an attacker uses to talk their way in.

What changes the day someone leaves?#

Same day: remove their access, change the shared secrets they could see, and confirm that no recovery phone or email still points at them. Departures are not always planned or friendly, so run the same routine for a suspension.

Disable their user in the hotel management system first, so the front desk is not exposed while the rest is being sorted out. Remove them from the vault, then change the shared passwords they could see, one different password per account. End their active sessions in the mail and file accounts, not just their password; a signed-in phone stays signed in otherwise.

Remove their phone number from every two-step setting and replace it with the hotel number. Remove their role on social pages and business profiles, and check who is listed as admin rather than who posts. Collect keys, devices and cards, and write the date and the person who did it into the register. Contractors, seasonal staff and the agency that runs the ads all count as leavers on their last day.

Vendor accounts deserve the same discipline; see a review of vendor remote access, integrations and API keys.

How does the hotel get back in when the only person who knew has gone?#

Through recovery routes you tested earlier: the recovery email, the recovery phone, the printed codes, and the platform's own account recovery process. Each of those has to exist before you need it.

Test one recovery route per quarter on a low-risk account, so the first test is not on the domain. Know which accounts have no self-service recovery and need a support ticket, because those take days and sometimes a phone call in office hours. Registrar recovery often asks for proof of ownership: keep the domain invoice and the company details in the sealed envelope.

If the person is reachable, ask for a handover rather than starting a fight; if not, follow the platform's process and write down every step you took. Do not open a second account to start again: for a domain or a business profile that loses history, reviews and mail, and it can look like impersonation. After any recovery, change the password, the recovery phone and the recovery email in the same sitting.

Paper in the safe: what is acceptable for a small property?#

For a small property, a sealed envelope in the safe is acceptable, provided two people know it exists and it is opened, logged and re-sealed on a schedule. Paper is a fallback, not the system.

What goes in: the printed master key, the recovery codes, the account register, the list of recovery numbers, and the sealed business documents that prove ownership. Keep two envelopes in two places, for example the hotel safe and the owner's office or a bank box. Log every opening with a date and a name, then re-seal in a fresh envelope; an envelope that has been opened quietly is no longer evidence of anything.

Paper fails silently: nobody is alerted when it is photographed, so keep the circle of people who know about it small. Never keep secrets in a desk drawer, a messaging app, a shared note, or a spreadsheet named passwords. Once the property has more than a handful of staff, the vault becomes the primary store and paper becomes the emergency copy.

What to do this week#

List the five accounts whose loss would stop the hotel, and write an owner, a backup and a recovery phone for each one. That single page is the foundation: the vault stores the secrets, the register says where they live, the two-step phone decides who can get in, the leaver routine keeps it current, and the tested recovery route is what saves you when the page is all you have.