A password manager for a small team: setup that sticks

Short answer: Pick one business password manager, set it up with at least two owners, create a handful of shared vaults or collections that mirror how your team actually works, then move everyone over in two weeks: owners and shared logins first, staff and their own work passwords second. After that, the habits that keep it alive are simple: new logins go straight into the manager, leavers are suspended on their last day, and passwords that were shared get changed.

Why small teams stall halfway

Most small firms already "have" a password manager: one person uses one, a few logins are in it, and the rest live in a spreadsheet called passwords-FINAL, sticky notes and everyone's browser. The tool isn't the problem. The rollout is. Nobody decided what goes where, nobody owns it, and the old spreadsheet never gets deleted, so people keep using it.

The fix is to treat it as a short project with an owner, a structure and an end date.

Choosing the tool

The well-known business options (1Password and Bitwarden are two examples) do the same core jobs: store logins, generate strong passwords, fill them in browsers and on phones, and share selected items with selected people. When comparing, check:

• Sharing model. 1Password uses shared vaults; Bitwarden organizations use collections. Both let you decide who sees which group of items.
• Roles. Bitwarden's documentation lists three default member roles (owner, admin and user), with owners alone able to see billing and appoint other owners. 1Password has built-in groups such as Owners and Administrators, plus custom groups with specific permissions.
• Recovery. What happens when someone forgets their main password? In 1Password Business, owners and administrators can recover accounts for team members, and custom groups can be given that permission.
• Passkeys. Bitwarden's help pages describe saving and autofilling passkeys for other services from the vault; check that whichever tool you pick supports passkeys on the browsers and phones your team uses.
• Importing. Bitwarden, for example, imports from Chrome, Edge, Firefox, other password managers and CSV files.

Both vendors recommend having more than one owner, so a single person leaving or losing a phone can't lock the business out. Treat that as non-negotiable.

A vault structure that makes sense on day one

Create vaults (or collections) around who needs access, not around apps. A hypothetical eight-person design studio might use:

Name vaults plainly. Five to eight shared vaults is plenty for most small teams; dozens of tiny ones get ignored.

The rollout plan

Week 1: owners and shared logins

• Day 1: subscribe, set up the account, add the second owner, and store the account's recovery details somewhere offline and secure. Canada's Centre for Cyber Security advises that if you must write down your primary password, keep it properly stored, such as in a locked safe, and limit who can access it.
• Day 1–2: turn on multi-factor authentication for every member, which the Centre also recommends. Use an authenticator app or security key, not SMS, where you can.
• Day 2–3: create the shared vaults from your table.
• Day 3–5: move the shared logins in: the spreadsheet, the sticky notes, the "ask Sam" passwords. Import from a CSV or browser export where the tool supports it, then check each item works. Rename items so they're findable ("Hosting – client X – admin").
• Day 5: change the passwords of the most sensitive shared accounts (bank, email admin, registrar), because the old versions have been in a spreadsheet. Generate new ones in the manager.

Week 2: everyone else

• Invite staff with a 30-minute session: install the browser extension and phone app, save one login, fill one login, find a shared item.
• Ask each person to import or move their work passwords from the browser into their private vault, then turn off the browser's own password saving on work devices so there's one source of truth.
• Delete the old spreadsheet. Actually delete it, including from cloud storage trash, once you've confirmed everything is in the manager.

Ongoing

• New accounts: whoever creates a login saves it in the right vault immediately, with a generated password.
• Leavers: suspend or remove them in the password manager on their last day, then change the passwords of every shared item they could see. 1Password's own guidance suggests asking departing staff to move work items into a shared vault before they're suspended, so nothing is stranded.
• Monthly: an owner checks the security report (weak, reused or compromised passwords, where your tool offers one) and fixes the worst three.
• Quarterly: review who has access to each shared vault.

Making it stick

People abandon password managers when they're slower than the old way. Remove that friction: make sure autofill works on the sites people use most, show staff how to share an item rather than paste a password into chat, and have one named person who answers "where's the login for…?" for the first month.

Passkeys can make this easier still. Where a service offers them and your manager supports them, saving a passkey in the shared tool means nobody types a password at all.

FAQ

Is the browser's built-in password saving good enough?

For one person, perhaps. For a team it lacks controlled sharing, roles and a clean way to cut off a leaver, which are the main reasons a business needs a password manager.

What if the password manager itself is breached?

It's a valuable target, so protect it with MFA and a long, unique primary password or passphrase. Reputable tools encrypt vault data on your device before it's sent to their servers; read the vendor's security documentation before you choose.

Should we store two-factor codes in the same tool?

Many managers can, and it's convenient for shared accounts. For the most sensitive accounts, keeping the second factor separate (a security key or a different app) is the safer choice.

How long does a rollout take for ten people?

Planned as above, about two weeks of light effort. The slow part is finding all the logins, not the software.

If shared logins are tangled up in your website, hosting and client systems and you want them sorted properly, describe what you're juggling.

Sources

• https://support.1password.com/business-security-practices/
• https://bitwarden.com/help/user-types-access-control/
• https://bitwarden.com/help/import-data/
• https://bitwarden.com/help/storing-passkeys/
• https://www.cyber.gc.ca/en/guidance/password-managers-security-itsap30025