Password managers for a small team

There is a spreadsheet. It might be called Logins, or Passwords, or Important Stuff. It lives on a shared drive, and there are two other copies of it — one on somebody's desktop, one attached to an email from 2022 — and they disagree with each other about the bank.

Everyone knows this is bad. What's less obvious is why it's bad, and the reason isn't that it's a spreadsheet. It's that a spreadsheet has no way to give one person access and take it away again, and no record of who opened it. Encryption isn't the missing feature. Revocation is.

What a shared vault actually buys you

Three things, none of which is "it's encrypted."

Per-person access. Credentials are granted to people and can be withdrawn from one person without touching the other nine.

A record. You can see who opened which entry and when — which matters most on the day something goes wrong and the honest answer to "who had this?" is "everyone, probably."

Unique passwords by default. A different long password for every service is the only realistic way one breached vendor stops at that vendor, and nobody achieves it by hand.

1Password, Bitwarden and Keeper all do this competently for small teams; Bitwarden also has a self-hosted option if that matters to you. Pick on price and on whether your least technical employee will actually use it — a tool half the team avoids leaves you with the spreadsheet plus a subscription. The manager built into your browser is fine for one person's own logins, but it's built around one person: no groups, no offboarding.

Structure it by function, not by person

Give everyone a personal vault for their own work logins, then create a small number of shared vaults along the lines of the work: Finance, Website and hosting, Marketing accounts. Grant access to groups, not individuals.

The mistake is one large "Company" vault that everyone can see. It's easier to set up and it recreates the original problem exactly — you still can't remove one person without rotating everything they could see, which is all of it.

The part the migration guides skip

Here's the thing worth taking away: most of what you're about to load into that vault shouldn't be in it at all.

Every shared login is a login you cannot attribute. When four people use one account, that service's own audit log records four people's actions under one name. The vault makes sharing safer; it doesn't make it good.

So before you migrate, go the other way. Wherever a service supports individual accounts with roles — Google Workspace, Microsoft 365, QuickBooks, Shopify, AWS, most banks' business portals, most modern SaaS — stop sharing one login and give each person their own with the permissions their job needs. Offboarding then becomes one click inside that service, no rotation required, and the audit trail has names in it.

The shared vault is for the leftovers: the domain registrar, the utility account, the twelve-year-old vendor portal that has exactly one seat, the Wi-Fi passphrase. Keep that list deliberately short. A team that moves forty shared logins into a vault has organized the problem. A team that converts thirty of them to named accounts has removed it.

Offboarding, done properly

Removing someone from the vault is the first step, not the last. They may still remember what was in it.

Remove their access, then rotate every shared secret they could reach — and the vault is what makes that possible, because for the first time you have an accurate list of which ones those were. Revocation and rotation are different actions, and doing only the first is the common way a departure turns into an incident months later.

What to do

Inventory everything, and start with the two that are usually in one person's personal email: the domain registrar and whoever hosts your DNS. Losing those loses the business.
Choose one tool and put the whole team on it. Two tools is a spreadsheet with extra steps.
Before migrating, convert every credential you can into named individual accounts.
Build small shared vaults for what's genuinely left, assigned to groups.
Turn on multi-factor authentication for the vault itself, and make sure your recovery path doesn't depend on a single device.
Delete the spreadsheet — every copy, including the one in the email thread — and rotate everything that was in it. It was readable by more people than you think.

Untangling a decade of shared logins is a good weekend's work, and I've done it before.