Does hiding a shared password keep it secret?

Sharing a password with the “hide password” setting in a password manager doesn’t keep it secret. LastPass, 1Password, Bitwarden and Keeper all say so in their own help pages: the person you share with still has ways to get it. What is a password manager? covers how vaults and sharing work.

The hide setting in each product

All four products let you share a login so the other person can autofill it without seeing the password. Setting names below are as they appear in each product. The last column sums up what each vendor itself says about the setting’s limits.

Why the person you shared with has the password

Autofill needs the real password, so the password itself reaches the other person’s computer. The app or browser extension on that computer is what types it into the sign-in page. The hide setting only stops the app from displaying it or copying it to the clipboard.

1Password’s help center explains this with three levels of enforcement. From strongest to weakest, they are cryptography, server policy and client policy. Whether someone can open a vault at all is cryptographic: only people with the keys can read it. Edits and deletions are refused by 1Password’s servers. Showing and copying passwords is left to the app on the person’s own device, the weakest of the three. 1Password says “the unencrypted data is still on their devices and could be extracted with some effort.” Keeper says the same of its setting. “Password masking is only visual in nature,” and the password stays in the user’s vault.

Ways the vendors say a hidden password can be read

LastPass and Keeper name specific methods, and the person you shared with can use each one on their own computer. LastPass also says highly capable users “could potentially access the password” with advanced techniques, without saying what those are. Bitwarden says hiding doesn’t completely prevent access and gives no method. 1Password says a determined team member “can easily overcome” client-enforced permissions on their own device.

A show-password button on the sign-in page

Some sign-in pages have a button that shows what you typed in the password field. LastPass says that if a hidden password is autofilled on a site with a “view password” option, the user can click that button and see it.

Another password manager

LastPass’s help center also says shared passwords can be obtained using another password manager.

The browser’s page inspection tools

Browsers come with tools for inspecting the page you’re on, often called developer tools. Keeper says the password can be reached by inspecting the browser. To stop users inspecting pages, Keeper recommends blocking developer tools through group policy, the browser settings an admin pushes to company computers.

What the vendors say the setting is for

1Password and Keeper don’t present the hide setting as a defense against someone acting in bad faith. 1Password calls client-enforced permissions “simple safeguards for people you already trust.” It says they “shouldn’t be relied on to prevent hostile behaviour or enforce trust.” Keeper says Privacy Screen is “commonly used to limit viewing of passwords for the less technical users.”

LastPass recommends least privilege for shared folders, with both Read Only and Hide Passwords turned on. It also recommends generating a strong password specific to the site you’re sharing, to avoid sharing “any passwords that you’re uncomfortable with the recipient obtaining.” Bitwarden says to handle a hidden password like any other shared login.

So the setting reduces accidental exposure: someone glancing at a screen, or writing a password down out of habit. It doesn’t stop the person you shared with from getting the password on purpose.

How to handle passwords you shared as hidden

Following the vendors’ own descriptions, manage a hidden password as if the person you shared with knows it. In practice that means three things.

1. Keep a list of everyone you shared it with. Hidden or not, each of them was in a position to get the password.
2. When you remove someone from the share, change the password on the service. 1Password says that once read access to a vault has been granted, it “can’t be taken away cryptographically.” Removal is enforced by the server, so a password that already reached their device may still be with them. The limits of changing shared passwords every time someone leaves covers the work that follows a change.
3. Give each service its own generated password. If passwords are reused, one known password opens other services too.

For people you’d rather not hand the password to at all, such as people outside your company or someone about to leave the team, the hide setting isn’t enough. If the service lets you create an account for each person, consider that first. Keeper’s page also points to another approach, Remote Browser Isolation. The browser session runs in an isolated container on Keeper’s gateway and is shown to the person inside their Keeper vault. Keeper says the login is autofilled there and never exposed to the user. For shared accounts you can’t split, Comparing ways for several people to use one shared account shows, method by method, whether each person learns the password.