Yes you have only the master password, and also no way of ever choosing your own since that is the masterkey for your blockchain wallet. So you need to take them through regenerating a new set of keys to be safe, but if you opt not to they need to know that they then go to wallet and view all the private keys one by one and copy them down, including the initial password they got MASTER KEY , keep this safe on an offline usb , paper in their wallet, something. Once they have

• Master Key
• Posting Key
• Active Key
• Memo Key

then they can logout and log back in using the posting key, keeping in mind the browser will ask to remember , which is ok. Kind of helps becuase a spam site url won't match so if asked to log in you will wonder why your browser or password manager did not fill this info out. When doing wallet activities they need the "active key" and may go copy that when required but do not let the password manager or browser remember or update the original posting key as your default pass. Same with steemconnect.