# Agency shared passwords spreadsheet: what replaces it > A spreadsheet of client logins breaks two-factor sign-in and leaves nothing to revoke. Partner access first, then one vault per login with its code. Source: https://mosaicbrowser.com/blog/shared-password-spreadsheet ## The shared password spreadsheet, and what replaces it A spreadsheet of client logins breaks two-factor sign-in and leaves nothing to revoke. Partner access first, then one vault per login with its code. ![One sheet of client logins, and what goes wrong with it](https://mosaicbrowser.com/covers/shared-password-spreadsheet.webp) An agency's shared password spreadsheet usually starts as one tab with three columns, client, site and password, and it fails in two ways. It cannot hold two-factor sign-in, so people either keep the codes on one phone or turn two-factor off. And it gives you nothing to revoke: when someone leaves, the only way to take their access back is to change every password they could read. What replaces it is partner access where the platform has it, and a vault per login for the rest. ## Why an agency password spreadsheet breaks two-factor A client who turns on two-factor authentication for a shared login has added a second thing the sheet cannot hold. A text-message code goes to the client's phone, so someone at the agency asks for it on a call each time. An authenticator app goes onto whichever account manager scanned the QR code, which works until that person is on holiday. The sheet's answer is usually a fourth column. Sometimes it holds backup codes, which are single-use and run out quietly. Sometimes it says "2FA off", because somebody switched it off to make the row work. Either way the spreadsheet has undone the client's security to fit into a cell. ## Nothing to revoke A spreadsheet is a copy, and copies spread. It gets downloaded, pasted into a chat, exported to a laptop, and every copy holds every row. Version history keeps the old passwords after they change. When someone who could read it leaves, there is no access to remove. Their account on the shared drive can be closed, but the passwords they saw are still the passwords. The honest offboarding step is to change every login on the sheet, one by one, and tell each client. Most agencies do not, and a row in that sheet then works for someone who no longer works there. Mosaic is a desktop app Email yourself the link and open it on your computer. How it works: App lock, backups and trash ## First, keep the logins out of the sheet The best row is one that never existed. The big platforms have a way in that needs no client password. On Meta, the client's business portfolio adds the agency's portfolio as a partner, and the agency's people work from their own Facebook logins. On Google Ads, the agency's manager account links to the client's account. In both, the client stays the owner, and ending the work means removing a partner, not changing a password. [Business portfolio and Business Manager](https://mosaicbrowser.com/blog/business-portfolio-not-business-manager) explains how partner access and ownership differ on Meta. That leaves the logins with no partner system: a store admin on a single-user plan, a newsletter tool, a supplier portal. Those still need a home, and the home should keep three things together: the login, its two-factor secret, and the account it belongs to. ## A vault per login, with its code beside it In Mosaic each profile is a separate browser with its own cookies, fingerprint and proxy, and each profile has its own credentials vault. A client's newsletter login goes into that client's newsletter profile, together with the TOTP setup key, the text version of the QR code the site shows when two-factor is turned on. Whoever opens the profile gets the code from the companion, the extension inside that profile's browser. It shows that profile's codes only and fills them into the page with real keystrokes, so one client's codes never appear in another client's browser. ![The Mosaic companion inside a profile browser: notes, saved logins and two-factor codes for that profile](https://mosaicbrowser.com/shots/companion.png) *Logins and codes kept with the profile they belong to* The setup key is checked when it is saved, not when somebody first needs a code. That rule came from a bug of ours. A mistyped key used to be accepted, encrypted and stored, and the row then showed `--- ---` for ever, because the key was only decoded when a code was asked for. Now the key is decoded on the way in, in the store method that the window, the REST API and MCP all write through, and the refusal names the field. A key pasted in spaced groups, in lower case, or as the `otpauth://` link behind a QR code is read as the same key. A key that decodes to fewer than 8 bytes is refused as a fragment of a paste, because a truncated key decodes cleanly and then produces six wrong digits for ever. The window that lists the logins never receives a password. It knows one exists, and filling it into a page happens in the app's main process, so the plain text never reaches the interface. ## What revoking looks like afterwards With logins in profiles, the end of a client is one project to look at rather than a sheet to edit. Hand back what is the client's, remove your portfolio as their partner, then move that client's profiles to the trash. Trashing a profile closes its browser first. The order matters, and [client offboarding](https://mosaicbrowser.com/blog/client-offboarding-browser-profiles) gives the steps, including why the profile goes last. The first hour of a new client, set up so that this day is easy, is in [client onboarding](https://mosaicbrowser.com/blog/client-onboarding-first-hour). Mosaic keeps accounts you are entitled to run apart; it does not change what a platform allows. It also has no teams: a profile lives on the computer that made it, so the vault replaces the sheet for the logins worked from that computer, not for a shared drive. ## Questions ### Is it safe for an agency to keep client passwords in a spreadsheet? No. Everyone who can open the sheet holds every client's login, a copy of it outlives the person who made it, and there is nothing to revoke when someone leaves except changing every password in it. ### What should replace a shared password spreadsheet? Partner or manager access wherever the platform has it, such as Meta business portfolios and Google Ads manager accounts. For the logins that are left, a vault that keeps each password and its two-factor setup key with the one account it belongs to. ### How do you share a login that has two-factor authentication? Save the authenticator setup key, the text code a site shows beside its QR code, in the same place as the login, so whoever opens the account can generate the code. Do not turn two-factor off to make sharing easier. ### How does Mosaic store client logins? Each profile has its own credentials vault for logins and TOTP setup keys. The companion inside that profile's browser shows that profile's codes only and fills them with real keystrokes. A setup key that cannot make a code is refused when it is saved. ## Related [The first hour in the browser with a new client](https://mosaicbrowser.com/blog/client-onboarding-first-hour): A social media client onboarding checklist for the browser: ask for partner access, not passwords, then a project, a proxy in their market and their 2FA. [What to do with a client's browser profile when the contract ends](https://mosaicbrowser.com/blog/client-offboarding-browser-profiles): Agency client offboarding goes wrong when access is revoked before the client can sign in. Confirm the handover, export, then trash the profile by id. [Business Manager is now a business portfolio. What changed](https://mosaicbrowser.com/blog/business-portfolio-not-business-manager): Meta renamed Business Manager to business portfolio and moved nothing. An ad account still belongs to the portfolio it was made in, so check whose that is. [What is an anti-detect browser?](https://mosaicbrowser.com/guides/what-is-an-anti-detect-browser): An anti-detect browser gives each profile its own fingerprint, proxy and cookies, so sites see separate visitors. What it changes, how, and its limits.     ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.