My developer left and has all the passwords

It may have been a falling-out. They may simply have stopped answering. Either way, the only person who could sign in to your system isn’t there, and you’ve just realised what that means.

This guide is for when they’ve already gone. If they’re still around, even on their last week, read this instead, because it’s far easier while everyone is talking. And if nobody has left, but only one person knows how your system works, start here.

In the first hour

1. Don’t change anything you don’t understand. A system that works today is worth protecting while you get your bearings.
2. Look for what’s about to lapse. Go through the card statements. If a service is paid for on their card, it could stop when that card is cancelled. In one post on Microsoft’s forum, a business’s only administrator had been made redundant, their card was cancelled, the monthly payment bounced, and nobody else had the rights to fix it.
3. Check who gets the money. If your app takes payments, find out whose bank account they reach.
4. Start a file. Invoices, contracts, messages, and anything showing who paid for what. Nearly every route below asks you to prove something, and this is your proof.

Which situation are you in?

The message to send

Ask for a handover, not for their passwords. A password you’ve been given doesn’t remove their access, and it won’t help if the sign-in code still goes to their phone. A transfer solves both, and leaves a record. Be specific, because a short list is easier to act on than a vague request.

Getting back in, account by account

These routes come from each provider’s own pages as we read them on 6 November 2026. They change, so check before you rely on them.

1. The web address

Whoever controls this has the master key, because it’s what other services ask you to use as proof. Look up who holds it and where it’s registered. ICANN’s lookup tool covers addresses such as .com, though personal details are often hidden.

• If it’s in the company’s name, you’re in a strong position. Contact the company it’s registered through, and ask what they need from you.
• If it’s a .uk address in their name, the change has to go through Nominet, the .uk registry. UK registrars describe it as a transfer started from the current holder’s Nominet account, at a fee of £10 plus VAT. Nominet’s own pages wouldn’t open for us when we checked, so confirm this with them.
• If they won’t or can’t do that, Nominet has a Dispute Resolution Service. One firm of solicitors reports a case where a web developer registered an address for an architectural company, then stopped responding, leaving the company unable to manage its website and email. An independent expert directed that the address be transferred to the company. It helped that the address matched the company’s long-used trading name, and that the company had used it exclusively and had almost certainly paid for it. Your facts may differ.
• If it’s a .com or similar, the equivalent dispute policy is built around trade mark rights, so ask a solicitor whether it fits.

Whatever else you do, find the renewal date and put it in your diary. Don’t let the address lapse while you sort this out.

2. The company email

• Google Workspace. Google documents a route. Try its automated recovery first, then ask for support-assisted recovery, for which you’ll need to add a record to your web address’s settings to show you control it. An ordinary user who can’t reach their administrator can also ask to be promoted. Google contacts the existing administrators, and says it will promote you if they’re “inactive and unresponsive”. So you can see why the web address comes first.
• Microsoft 365. We didn’t find one official page that sets this out for a small business. Microsoft’s documented admin takeover only covers what it calls unmanaged directories. In the forum post above, a moderator’s advice was to phone Microsoft, ask for Commercial Account and Billing Support, and say that the only admin has left. That’s forum advice and not a promise, but it’s somewhere to start.
• Their personal Gmail or similar. That account is theirs. Don’t try to get into it. Instead, work through each service that hangs off it, and expect this to be the hard part.

3. The app builder

This is often the weakest point. We looked for what happens when an owner has simply gone, and found no documented route on Lovable, Bolt or v0. Replit says accounts “can’t be transferred directly”. Our tool pages set out what each one says. Contact the provider’s support anyway, with your file of proof, ask what they’d accept, and keep their reply.

4. The code

If your code is on GitHub, be realistic. GitHub says that if an organisation has only one owner, its projects can become inaccessible if that owner is unreachable. And its support won’t restore access to an account with two-step sign-in if the credentials and recovery methods have gone. So look for other copies: old laptops, earlier suppliers, or anyone else who ever worked on it.

5. Everything else

Work down the card statements and the list of what to look for: the database, hosting, email sending, connectors and spreadsheets. Once you hold the company email, password resets for anything registered to it will start reaching you.

What not to do

• Don’t use their login to get into an account in their own name, or ask a new developer to “just get in”. Under the Computer Misuse Act 1990, it’s an offence to access a computer’s programs or data when you know you aren’t authorised, and section 17 turns on who is entitled to decide and who has consented. An account plainly owned by the business, with its password kept on file, is a different matter. If you can’t tell which you’re looking at, ask a solicitor first. It doesn’t help that the system feels like yours. More on who can give permission.
• Don’t pay anyone who promises to break into an account for you. You’d be taking on their risk as well as your own.
• Don’t rush into a rebuild. Rebuilding in a panic is how you lose what’s good about a working system, and you’d still need your data out of the old one.
• Don’t write anything you wouldn’t want read out later. A solicitor or an independent expert may end up reading those messages.

Check whether the clock is running

Few owners think of this at the time. The ICO says a personal data breach includes someone accessing data “without proper authorisation”, and data being made unavailable where that “has a significant negative effect on individuals”. A lockout from a system holding customer records could therefore count. So could finding that a former developer has been using their access, or has copied the data.

A lockout that affects nobody, or a leaver whose access hasn’t been used, may well not be reportable. But you have to think about it, and you should write down what you decided. If a breach does meet the threshold, you must report it within 72 hours of discovering it. The ICO has a breach advice line on 0303 123 1113, and it says its main aim is to give advice. Its guidance is under review following recent changes to the law, so check for the latest. UK GDPR and your app has more.

Getting in isn’t the same as owning it

Winning back the logins doesn’t settle who owns the code. Work done by an employee in the course of their job belongs to the employer. But a freelancer usually keeps the copyright, even after being paid in full, because a transfer has to be in writing and signed. If you’re agreeing anything with them, get that signed at the same time. Who owns your system? explains more. This guide is general information and not legal advice.

Once you’re back in

1. Close the old doors. Remove their access, change shared passwords and replace every secret key they could have seen. Keys carry on working whatever happens to a login. The leavers’ checklist has the full list.
2. Make sure this can’t happen again. Put every account in the company’s name, with at least two people able to sign in. GitHub recommends two owners for just this reason.
3. Find out what you’ve inherited. Nobody may fully understand it now. An audit gives you a map, a list of who can get in, and what to fix first. We won’t try to get into an account without the right permission, but once you have the keys, we can help you decide what to do next. If running it isn’t anyone’s real job, we can take it on.

Questions

By Selwyn Doling, VibeTend. Last updated 6 November 2026.