Best practices for sharing passwords in Password Boss

Gain insight into strategies for successful collaboration and learn how to successfully share passwords across a team.

Updated at July 21st, 2025

+ More

Table of Contents

Use sharing - it is an excellent way for your team to collaborate Sharing items in Password Boss Use groups to share items Use groups to manage users Understand Roles and Permissions Roles and permissions for recipients of shared items

Sharing is one of the most powerful features in Password Boss, and it gives you a secure way to collaborate with your team.

Sharing items in Password Boss allows you to securely provide access to passwords, notes, and other sensitive data to individuals or teams. Sharing supports granular permission levels, visibility controls, and seamless transitions into Company Vaults for scalable access management.

Sharing lets you grant controlled access to items stored in your Password Boss account. Each recipient receives a permission level that determines what they can see and do.

Shared items appear in the recipient’s Shared with Me list and enforce all visibility rules across the WebApp, Browser Extension, and mobile apps.

Each recipient is assigned one of the following roles.

Editor

Editors have full visibility and can modify items.

Editors can:

View all item details, including passwords.
Edit fields.
Add items to the share.

Editors cannot:

Remove the Owner.
Convert the share to a vault.

Read‑Only / Password Visible

Recipients can see all details but cannot modify the item.

Can:

View everything, including passwords.
Use autofill.

Cannot:

Edit or delete.
Add items.

Read‑Only / Password Hidden (Invisible)

Invisible is the most restrictive role.

Can:

Use autofill to log in without seeing the password.
Access non‑sensitive metadata (if allowed).

Cannot:

View or copy the password.
Access hidden fields.
Extract credentials via extension or API.

Updated Behavior

Copy Password is fully suppressed in the WebApp and Browser Extension.
Autofill remains available.
Invisible access does not migrate when converting to a vault

Shared items normally appear in the recipient's account a few minutes after creating the Share. Recipients will receive an in‑app prompt to accept the share.

WebApp

Open Password Boss.
From the left menu, choose Share Center.
Click on the Add Share button to create a new Share.
The Create a new Share window will open.
Select the profile you want to share items from.
Check the box next to each item or folder you want to share.

7. Click Next.

8. Enter a Name for the Share, add recipients, pick a permission (Invisible, Read, Editor), and click Add, use the How Long Should the Items be Shared feature (optional), and Save Share.

The recipient can then open the Share Center, and on the Shared with Me tab they can Accept or Decline the Share.

Desktop

Open Password Boss.
From the left menu, choose Share Center.
Click on the orange circle to create a new Share.
The New Shared Item window will open.
Select the profile you want to share items from.
Check the box next to each item or folder you want to share.
Click Next.
Enter a Name for the Share, add recipients, pick a duration and click Share item.
The recipient can then open the Share Center, and on the Shared with Me tab they can Accept or Decline the Share.

iOS

Open Password Boss.
From the bottom menu, tap More
Tap Share Center.
Tap the green and white circle
Tap Individual Items or Entire Folder.
Tap the items you want to share.
Tap Next.
Enter a Name for the Share, add recipients, pick a duration, and tap Share item.
The recipient can then open the Share Center and on the Shared with Me tab, they can Accept or Decline the Share.

Android

Open Password Boss.
From the top left tap the menu icon
Tap Share Center.
Tap on the orange circle
Tap Individual Items or Entire Folder.
Tap the items you want to share.
Tap Next.
Enter a Name for the Share, add recipients, pick a duration, and tap Share item.
The recipient can then open the Share Center and on the Shared with Me tab,they can Accept or Decline the Share.

Managing Existing Shares

You can edit or remove share recipients using the item’s Share Details panel.

Actions Include:

Changing roles (Invisible → Reader → Editor).
Removing a recipient.
Reviewing activity logs.

Changes apply instantly across all devices.

Sharing can be upgraded into a structured vault.

When to Convert

Use a vault when:

Multiple people need ongoing access.
You want role‑based management.
You want the ability to assign multiple Owners.

Important Rules

Items are moved to the vault.
Clone items in other shares stop being shared elsewhere.
Invisible recipients are not added to the vault.
Former recipients must be assigned Vault roles manually.

Behavior in the Browser Extension

The Browser Extension displays only the actions that match the recipient’s role.

Editor: Full view, editing shortcuts.
Read‑Only Visible: View and autofill.
Invisible: Autofill only; no copy, no reveal.

If a shared item becomes part of a vault, extension behavior follows the Vault role, not the original share role.

Behavior on Mobile Apps

Password visibility follows permission level.
Invisible users attempting to reveal a password see a Not permitted message.
TOTP is shown only if visibility is part of the assigned role.

Security Considerations

Sharing uses Zero‑Knowledge encryption.
Only the Owner and approved recipients can decrypt items.
Invisible mode exists to allow login use without exposing secrets.
Activity Logs track role changes, recipient additions/removals, and vault migration.

Summary

Sharing supports granular permissions.
Invisible users have the strictest restrictions and cannot migrate to vaults.
Role changes take effect instantly everywhere.
Converting shares to vaults centralizes control and enhances team management.

An administrator for your team can create groups of users on the portal—for example, Marketing, Finance, HR, etc. When users are added or removed from your team, have the admin update the group membership on the portal.

When you create shares, choose groups instead of individuals as recipients. When groups are used, you will not need to edit the share when your team membership changes. As long as the user's team members are added to the groups on the portal, they will automatically receive the shared data when they login to their Password Boss account.

Use groups to manage users

Why you should use groups

Groups are designed to make it easy to manage recipients of shared items. The benefits of using groups include:

Shares sent to groups are automatically updated as the membership changes. If shares are sent to individuals, each must be manually edited as the recipient list changes.
It is quicker to manually choose groups as recipients then add each recipient individually.
If you need to review a share and who has permission to share, you do not need to scroll through long lists of recipients.

The Everyone group

All teams have an Everyone group that is automatically created for your team. The Everyone group contains all team members from your account. The membership of the Everyone group is maintained automatically by Password Boss.

The Everyone group includes everyone in your account. Only share to the Everyone group as a recipient when all team members need access to the shared items. If only some team members need access to the shared items, create a new group with limited membership.

Use meaningful names for groups

Use names for your groups that describe the group so that other team members can identify the group. Group names that identify the group, project, or department make it easy for other team members to know what the group is for. Examples: Marketing, Finance, Project Alpha.
Consider adding the permissions to the name of the group.
Depending on your team structure, it may be useful to create groups that will be used to assign read-only permission and other groups with editor permissions. Examples: Marketing-Read Only, Marketing-Editor, Sales-Read Only, Sales-Editor, Admin-Read Only, Admin-Editor.

Avoid duplicating groups

Keep your list of groups concise and avoid making groups that duplicate the membership in an existing group.

How to create groups

Login to the Password Boss portal as an admin for your team.
Click Users & Groups from the left menu.
Scroll down to the Groups section.
Click +Create New Group.
Enter a group name and click save.

How to add or remove users from a group

Login to the Password Boss portal as an admin for your team.
Click Users & Groups from the left menu.
Scroll down to the Groups section.
Find the group you want to change.
From the blue Actions button Choose Edit.
Add or remove users from the group. You can also edit the name of the group from this screen.
Click Save when you are done.

How to delete groups

Login to the Password Boss portal as an admin for your team.
Click Users & Groups from the left menu.
Scroll down to the Groups section.
Find the group you want to change.
From the blue Actions button Choose Delete.
On the confirmation screen, click Delete group.

Understand Roles and Permissions

When you create a share, you can use permissions to control the visibility of password items in the share.

Roles and permissions for recipients of shared items

This article explains the permissions available when sharing items in Password Boss, how each permission works, and what recipients can or cannot do with shared items. It includes updates to reflect recent product changes, including suppressed Copy Password actions for Invisible shares across the WebApp and Browser Extension.

Owner

The Owner role represents the highest level of control for both shared items and vaults.

Owners can:

View and edit all item fields, including passwords.
Add or remove items from the share or vault.
Change any recipient’s role (Editor, Read‑Only, Invisible).
Revoke access for any recipient.
Move items into or out of a Vault.
Convert a Share to a Vault (when applicable).
Manage Vault membership and Vault roles (Owner, Editor, Reader).

Owners cannot:

Bypass Zero‑Knowledge rules (they cannot view hidden content if they do not possess the required encryption keys).
Be removed by other recipients—only another Vault Owner (in multi‑owner vaults) or the system administrator (for Business accounts) can replace/remove an Owner.

Differences Between Owner of a Share vs. Owner of a Vault

Share Owner: The person who originally shared the item(s). They control roles and access but do not have Vault‑level management options.
Vault Owner: Controls the entire Vault, its contents, and membership. Vault Owners can add/remove multiple items at once, invite members, and set roles for each member.
Converted Shares → Vaults: After conversion, Vault Owner(s) inherit full control; former share recipients do not automatically become Vault Owners.