Emergency Access to Company Credentials, Without a Single Keyholder
Most small companies have one person who knows the domain registrar login, the cloud root account or the password manager's recovery key. That's a single point of failure in both directions: if they leave or get hit by a bus, you're locked out; if they turn, nobody can stop them.
What counts as a break-glass credential
- Cloud provider root or owner accounts (and their MFA recovery codes).
- Domain registrar and DNS logins: lose these and you lose your email and website.
- The admin or recovery key of your company password manager.
- Code signing keys, app store accounts and payment provider owner logins.
- Bank and treasury access, including any company crypto wallets.
These should rarely be used, but when you need them, you need them now.
Why the usual answers fall short
- One trusted admin: concentrates risk in one person's availability and integrity.
- A shared vault everyone can open: fine for daily credentials, too broad for root access.
- An envelope in the safe: anyone with the safe has everything, and nobody updates the envelope.
Dual control with a threshold
A threshold scheme means a chosen number of people must act together. For example, any 2 of 3 founders, or 3 of 5 across leadership and an outside advisor. One person can't use the credentials alone, and one person leaving doesn't lock the company out.
ShareMySecret applies Shamir's Secret Sharing on iPhone: the credentials are encrypted on-device with AES-256, the key is split among the people you pick, and each person receives one key share together with the encrypted secret. There is no server, no account and no vendor that can be breached or subpoenaed for your secret.
A simple break-glass policy
- Inventory the credentials that would stop the business if lost.
- Write the runbook with the credentials: what each is for and the first steps in an emergency.
- Choose holders and a threshold, spread across roles so no single team or relationship controls a quorum.
- Distribute the shares. Each holder needs ShareMySecret on their own iPhone.
- Rotate on change. When a holder leaves or a credential changes, rotate the credential and create a new secret with the current holders.
- Rehearse recovery once a year so the process is known before it's needed.
Where it fits, and where it doesn't
This is for rare, high-impact credentials, not for daily shared logins, which belong in a team password manager. Recovery in ShareMySecret depends on people combining shares in the app, not on an audit trail or approval workflow, and every holder needs an iPhone. Larger organizations with compliance requirements may need an enterprise secrets manager alongside it. Read the threat model before you decide.
Try it with your own secret
ShareMySecret is free to download for iPhone. No account, nothing stored on our servers.
Frequently asked questions
What is a break-glass account?
An emergency credential with high privileges, such as a cloud root account or a domain registrar login, kept for situations where normal access fails. It should be hard to use casually and easy to recover when it's genuinely needed.
How can a small company avoid depending on one person for its passwords?
Protect the most critical credentials so a group of people, for example any 2 of 3 founders, must cooperate to open them. No single person can misuse them, and one person leaving doesn't lock the company out.
What should we do when a key holder leaves?
Rotate the affected credentials and create a new secret with the current holders. Shares held by a former holder are useless below the threshold, but rotating removes any doubt.
Is this a replacement for a team password manager?
No. Keep daily shared logins in a team password manager. A threshold backup is for the few credentials whose loss or misuse would stop the business, including the password manager's own recovery key.