AccessURL Makes Sharing Accounts Easy, Without Sharing Passwords

If you’ve ever read a password guide, one of the tenets – apart from having a strong password in the first place – is to never share your password with anyone else. The reality can be a bit different – you might share your Netflix or Spotify subscription with someone else, maintain family photos in one Google Drive account, or use a common Amazon Prime membership to order stuff.

For all of those needs, AccessURL – an extension for Google Chrome – wants to be of service. It’s designed to let you share access to any of your online accounts, provided it’s a website, without having to also share the password. And it works pretty simply too – both parties have to install the extension, and then you open the website and click on the AccessURL icon in your Chrome navigation bar. Next, you decide when you want the link to expire – a day, a week, or never – and the extension will then provide you with a link to share with your friend or family member. Obviously, security is paramount with a tool like this, and the folks at AccessURL say they use AES, the industry standard for encryption.

The extension doesn’t have access or store your username and passwords, but instead relies on cookies. “Websites use cookies to keep you logged in across pages,” co-creator Jarred Sumner explains over at Product Hunt. “This just takes the cookies used by the current domain, generates a random password, encrypts those cookies with that random password, and then sends the encrypted cookies without the password off to the server. Then, when another user goes to your access URL, the chrome extension takes the password from the URL (which is what shows up in the #), it decrypts the cookies, and then adds them to Chrome's cookie jar.”

The developers say everything is encrypted before it's served on the server-side, which means even if some third-party is able to get access to their servers, your sessions will still be safe. Whether you are comfortable sharing links via relatively obscure developers, however, is another matter altogether.

AccessURL’s website mentions that if the sender were to log out from the website, anyone using the provided URL will get signed out too. That didn’t work out neatly for us, as we were still able to navigate someone’s Netflix account even though they had logged out on the other end. It even works with services like Gmail, which means you can use AccessURL to give temporary access to your email, without actually sharing the password to your account. With Gmail, if the original user signs out and ends the session, you can still look at mails and create drafts, but can’t actually send anything.

For what it’s worth, AccessURL also provides a central hub to manage your activity, where you can go and delete any URLs you've given out. Doing this worked just fine to limit access.

This method of sharing accounts is different from how a password manager like LastPass enables it. With LastPass, you can share one or multiple passwords with other LastPass users, which are then synced between vaults. With AccessURL, no string of text is shared and only access to the account is provided. That’s helpful as most people tend to reuse the same password across various websites, even though that’s another bad practice.

What works best for you then will depend on whom you’re sharing with, and what the use case is. If the shared account is going to be used frequently and across devices, LastPass is the better option. But if all you need to do is share access to your HBO Go subscription for a night with a friend who loves Game of Thrones, then AccessURL is more convenient.