Caveat: I basically know nothing about information security, so I apologize in advance. I'll try to keep the question as general as possible.

I have a website *X* over which I have administrator privileges (someone else helped set up the website for me, though). There are users *A,B,C* on my website, with usernames and passwords.

I assume that somewhere in the infrastructure of my website, there's a:

* Table of registered usernames
* Table of encrypted passwords using a hash algorithm
* Some description of what this hash algorithm is

My *trusted friend* (important, because the security problem isn't that he might be shady) is making a different website *Y*. He wants *A,B,C* to be able to log into *Y* using the same credentials that they use for *X*. This is just a one-time thing; if *D* joins my website *X* tomorrow, my friend doesn't care about having *D* be able to use his login credentials on *Y*.

However, not all of my users necessarily want to join *Y*, and I don't know *a priori* which of them do.

What information can I give my friend such that, if *A* and *C* want to log into *Y* with their *X* credentials, they can, but also ensuring that the information of *B* is protected?

---

Note: I understand fully that *A,B,C* shouldn't be re-using their passwords on multiple websites, but *X* and *Y* are related in some way such that it would not only be convenient for the users, but it would also just make sense for them to have the same login credentials.