Roll out a password manager to your small team

By the end of this guide, everyone on your team will use a password manager on their computer and phone, shared passwords will live in it instead of a spreadsheet, and the most important accounts will have strong, unique passwords.

Who it's for

Owners and office managers of small businesses, roughly 2 to 50 people. Setup takes an afternoon, plus about two weeks for everyone to settle in. You'll need a budget of a few dollars per person per month for a business plan.

Why bother: people reuse passwords because remembering dozens is impossible, and teams share passwords through spreadsheets, sticky notes and email. A password manager remembers every password, creates strong ones, fills them in automatically, and lets you share access safely and take it back when someone leaves.

Steps

1. Choose a business plan

   Pick a well-established password manager that offers a business or teams plan, such as Bitwarden, 1Password or Keeper. Make sure the plan includes:

   • Shared vaults (sometimes called collections or folders), so you can share a set of passwords with a group.
   • An admin console, where you can add and remove people and see who has access to what.
   • Account recovery for staff who forget their master password, and a way to take back access when someone leaves.
   • Apps and browser extensions for every system your team uses, including phones.

2. Set up the admin side first

   Create the business account and make two admins, for example the owner and one trusted colleague, so you're never locked out if one is unavailable. Turn on two-step sign-in for both. Then create shared vaults by job, not by person: for example Finance, Website & social media, Office Wi-Fi & devices and Suppliers.

3. Move the shared passwords in

   Gather every shared password: the spreadsheet, the sticky notes, the "passwords" email thread. Put each one into the right shared vault. When they're all in, delete the old copies, including from email folders and the trash.

4. Get each person set up

   Invite everyone. Sit with each person for fifteen minutes while they:

   • choose a master password: a long passphrase of four or more unrelated words that they don't use anywhere else;
   • turn on two-step sign-in for the password manager itself;
   • install the browser extension and the phone app;
   • import the passwords saved in their web browser, then turn off the browser's own password saving, so there's only one place to look.

5. Fix the most important passwords first

   Most password managers include a health or security report that lists reused, weak and leaked passwords. Start with the accounts that matter most (email, banking, payroll, accounting, the website and any admin accounts) and replace each password with a long random one the manager generates. Work through the rest over the following weeks.

6. Plan for people leaving

   Write a short checklist for when someone leaves: remove them from the password manager, then change the shared passwords they could see, starting with the most sensitive. Review who has access to each shared vault every three months.

Common mistakes

• A weak or reused master password. It protects everything else. Make it long, unique, and never written on a note stuck to the screen.
• Only the owner uses it. The benefit comes when everyone does. Set people up in person rather than sending an invitation and hoping.
• Keeping the old spreadsheet "just in case". That spreadsheet is exactly what attackers look for. Delete it once everything is moved.
• A single admin. If the only admin leaves or is unreachable, you can lose control of the account. Always have two.
• Not changing shared passwords when someone leaves. Removing their access to the manager doesn't stop them from using passwords they remember or copied.