Password Managers for Small Teams: What They Do and How to Start

What you will need: About an hour for setup, a list of the accounts your team shares, and one person to own the rollout.

What a password manager is

A password manager is an app that stores your logins in one encrypted, locked place called a vault. ("Encrypted" means the contents are scrambled so only someone with the key can read them.) You unlock the vault with one strong master password, and the app fills in your other logins for you.

Most password managers can also:

• Create long, random passwords so no one has to invent them
• Fill in logins on websites and in apps
• Share specific logins with specific people
• Work on phones and computers

Why a shared password spreadsheet is risky

A spreadsheet feels simple, and it's easy to see why teams use one. But it has some built-in problems:

• Everyone who can open the file sees everything. There's no way to share only the logins a person needs.
• Copies spread. The file gets emailed, downloaded, synced to personal devices, and backed up in places you may not remember.
• Anyone who gets the file can read it. A regular spreadsheet isn't a locked vault.
• There's no history. You can't easily tell who looked at or changed a login.
• People leaving is a headache. Someone who leaves may still have a copy, so you'd have to change every password in it.
• It encourages weak habits. Reused, easy-to-remember passwords stick around when changing them is a chore.

Step 1: Choose one person to own it

Pick someone (often the owner or office manager) to be the admin: the person who sets things up, invites people, and handles changes when staff join or leave. Name a backup person too, in case the admin is out or leaves the business.

Step 2: List what you have

Open your current spreadsheet, or just brainstorm, and list the accounts your team uses. Mark each one as:

• Shared: the whole team or a group uses it, such as a bank portal, payroll, or a social media account
• Personal: only one person needs it

Flag the most sensitive accounts, like banking, payroll, email, and your website or domain host. You'll secure those first.

Step 3: Pick a business-friendly password manager

Look for a plan made for teams, not just individuals. Compare a couple of options against this checklist:

• Sharing by person or group. You can share a login with specific people, not everyone.
• An admin role that can invite people and remove their access.
• Two-factor authentication (2FA), an extra step at sign-in, such as a code from your phone, that proves it's really you.
• Works on your team's devices: Windows, Mac, iPhone, Android, and the web browsers you use.
• A clear recovery plan. Ask what happens if someone forgets their master password, and what happens if the admin does. The answer varies a lot between products, and with some, a lost master password with no recovery set up means a lost vault.
• "Zero-knowledge" or end-to-end encryption. This means the company that makes the app can't read what's in your vault. Look for it on the product's security page.

We aren't ranking products here, because the right fit depends on your devices and how your team works.

Step 4: Set up the admin account first

1. Create the team account.
2. Choose a strong master password. CISA (the U.S. government's cybersecurity agency) recommends a passphrase of 5 to 7 random, unrelated words. It should be long, but memorable enough that you never need to write it down.
3. Turn on 2FA right away.
4. Set up the recovery option the product offers, and keep any recovery key or emergency kit somewhere safe and offline, like a locked drawer or a safe. Don't keep it in the old spreadsheet.

Step 5: Create shared folders

Most team plans let you organize logins into shared groups. The name varies: you may see "collections," "shared folders," or "groups." Set up a few based on who needs what, for example:

• Everyone: the Wi-Fi password, shared software
• Finance: banking, payroll, accounting software
• Marketing: social media, website

Only give each person access to the groups they need.

Step 6: Move your logins in

You can type logins in one at a time, or import them. If you import:

1. Check the password manager's import instructions first. Most expect your columns to have specific names, such as website, username, and password.
2. Export (save) the spreadsheet as a CSV file, a plain-text table of your data.
3. Import it using the password manager's import tool.
4. Check that the logins landed correctly and sort them into the right shared folders.
5. Delete the CSV file from your computer, your Downloads folder, and the Trash or Recycle Bin. It contains your passwords in plain, readable form.

Step 7: Replace weak and repeated passwords

Start with the sensitive accounts you flagged in Step 2. Use the password manager's generator to create a new, long, random password for each one, and turn on 2FA for those accounts where it's offered. Start with email: whoever controls your email can often reset everything else. Then work through the rest over the following weeks.

If your business uses Microsoft 365, our guide to turning on two-factor authentication for Microsoft 365 walks you through it.

Step 8: Invite your team

1. Send invitations from the admin account.
2. Ask each person to create their own master password and turn on 2FA.
3. Have them install the app and the browser extension on their devices.
4. Walk through one real login together so everyone sees how saving and filling work.

Keep it short and hands-on. Ten minutes of practice does more than a long explanation.

Step 9: Retire the spreadsheet

Once everyone is set up and the logins are in the vault:

1. Delete the old spreadsheet.
2. Check for copies in email attachments, shared drives, and Downloads folders.
3. Let the team know the vault is now the only place passwords live.

Step 10: Set a simple routine for staff changes

Write down a short checklist for when someone joins or leaves:

• New person: invite them and add them to the right shared groups.
• Departing person: remove their access right away, then change the passwords on any shared accounts they could reach.
• Every few months: have the admin review who has access to what.

A few habits that help

• Never share a master password. Each person gets their own.
• Don't send passwords by email or text. Share through the vault instead.
• Report lost devices right away. If someone loses a phone or laptop, tell the admin.

For more ways to protect your accounts, see five common security risks at a small business.

Need a hand?

If you'd like help choosing a tool or getting your team set up, we're happy to talk it through. Send us a note through our contact form.