Sharing a password is the wrong way to do this, and it is what most small businesses end up doing. It means you cannot tell who changed what, you cannot remove one person without changing it for everybody, and your own account is exposed.
Adding somebody properly takes a minute. They make their own login, they see your site in their dashboard, and you can remove them whenever you like. If they make a mess, History shows what happened and any earlier version can come back.
Step by step
Open your dashboard. People is near the bottom of the first page.
Enter their email, choose what they are allowed to do, and add them.
Four choices, from somebody who can only look to somebody who owns the site with you. The line under the box says what each one can do.
They get an email, make their own login, and see your site.
Remove them at any time from the same place.
If it does not go to plan
What can they do?
Edit and publish the site. Only an owner can change billing or connect a web address.
They already have a Kitset account.
That is fine. Your site appears in their list alongside anything else they work on.