The methods people actually use are worth naming because each fails in a predictable way. A shared document leaves the credentials readable by anybody who ever had the link, including after they leave. Sending them by message means they persist in both parties' history and in every backup of it indefinitely. A spreadsheet on a shared drive is both of those problems at once. And keeping them in one person's head means the business stops when that person is unavailable.
A password manager with a shared vault solves the mechanics properly. Credentials are encrypted, access is granted per item rather than wholesale, you can see who has what, and revoking somebody removes their access without disturbing anybody else. Most offer a business tier at a modest per user cost, and the free tiers of several handle small teams adequately.
The more important question is whether sharing is the right answer at all. Many services now support additional users with their own logins and restricted permissions, which removes the sharing question entirely. Where that option exists it is always better: everybody has their own credentials, actions are attributable to a person, and offboarding is a single click rather than a password rotation.
Reserve genuine sharing for accounts that do not support multiple users, which is a shrinking category but still includes plenty of smaller tools and utility accounts. For those, grant access to the specific item rather than to a folder, so that somebody who needs one login does not receive twelve.
Keep the critical accounts out of any shared arrangement. Banking, the domain registrar, and anything holding customer data should have access granted through their own permission systems where possible and should not be routinely shared at all. If somebody genuinely needs to perform a task in one of those, doing it yourself or granting a limited role is nearly always better than handing over credentials.
Turn on two factor authentication and understand how it interacts with sharing, because this is where arrangements break. A shared login protected by a code sent to one person's phone means that person becomes a bottleneck. Password managers handle this by storing the second factor alongside the credential, which keeps the protection and removes the dependency.
Write down who has access to what, and treat that list as the offboarding checklist. Access accumulates quietly, and a year into a business there is usually at least one person or one former contractor holding permissions nobody would grant today. Reviewing it every six months takes minutes.
Then change anything that was ever shared by an unsafe method once you move to a manager, because those credentials exist in message histories and documents you cannot fully retrieve. Migrating without rotating means importing the exposure into the new system.
Set up recovery before you need it, which is the part of this that fails silently. Emergency access in a password manager, designating somebody who can request entry after a waiting period, means a business does not stop because one person is unreachable. It takes minutes to configure and it is the least interesting item on any security list that most deserves attention.
Audit what is actually in the vault once a year, because it accumulates credentials for services nobody uses and for accounts that were closed. Removing those reduces what is exposed if anything goes wrong, and it also surfaces the subscriptions you forgot you were paying for.