How should I securely hand over client credentials if I’m unavailable?

You can also create a separate client emergency administrator account protected by a second factor that is stored separately from your normal equipment. Give the client the account name and password, but keep the security key or recovery method in a documented location that an authorized representative can access. Be careful with this approach: recovery codes, billing access, and account ownership still need to be documented, and a shared account is usually less auditable than individual accounts with delegated permissions.

A password manager with emergency access can work well here. Give a carefully chosen trusted person access to a client-specific vault, set a waiting period such as seven days, and require them to request access before anything is released. You can cancel the request during the waiting period, which prevents casual or impulsive access while still providing a clear handover path. Keep each client in a separate vault or account so an emergency release does not expose everyone’s credentials.

If you don’t trust anyone to manage a password manager account, use an offline escrow arrangement. Keep an encrypted password database on a USB drive in a fireproof safe, leave the unlock instructions in a sealed envelope, and replace the backup whenever important credentials change. The person holding it doesn’t need technical expertise, but they must be reliable and know exactly when they’re authorized to hand it over. The downside is that it requires a disciplined update process or the backup will become stale.

Start with ownership rather than just password storage. The client should own the domain registration, hosting account, billing details, DNS, and primary account email wherever possible. Create a client-owned administrator account for them, then add your own separate delegated account with only the access you need. That way they can remove you or hire someone else without needing your personal credentials, and your password manager is only a backup for the few secrets you genuinely need to hold.