Should I give an agency my password?

A shared password is worse than it looks for three separate reasons. You cannot tell who did what, so a deleted post or a changed bio has no author. Logins from an unfamiliar device and city often trip the platform's own security checks, and the account that gets locked is yours, not theirs. Worst of all, whoever holds the password can change the recovery email and phone, and at that point the account belongs to them in every practical sense. Getting a hijacked Facebook page back through a support form in Pakistan is a lottery that can run for weeks with no human to call.

Delegated access exists on all of them and takes about two minutes to set up. Facebook and Instagram are handled together in Meta Business Suite, where you assign a person a task-level role rather than full control. YouTube uses Studio permissions, where an agency should be an Editor and never an Owner — note that a channel sitting on a plain personal Google account cannot have extra managers at all until it is moved to a Brand Account, and that migration, not a password handover, is the correct fix. TikTok uses Business Center, LinkedIn uses page admin roles, and Google Business Profile has its own people list.

Two-factor authentication stays on your number. This is the part people get wrong even when they do everything else right — they set up 2FA using the agency's phone "because they log in more often", and then the agency controls the recovery path anyway. Your phone, your codes, and if a code is ever needed you send that one code, not the password.

We never take passwords, and if a client offers one we still set up proper access instead. On the day an engagement ends we ask you to remove us from every asset and we confirm in writing once you have. Do the same with anyone else you work with: put a reminder in your phone for the first of the month after you part ways, open each people list, and check that only the names you expect are still there.