Many small companies share passwords in a spreadsheet, a chat thread or on a sticky note. It works until someone leaves, a laptop is lost, or a supplier account has to be changed quickly and nobody knows who holds the login.
A password manager fixes this, but only when the whole company really uses it. This article describes a simple rollout that one person can run in two weeks.
Who gets it
Give a licence to everyone who logs in to any company account. That is usually the whole team, not only IT or management. A manager used by half the people leaves the other half sharing passwords in the old way.
Name one owner of the password manager. This is the person who invites users, creates vaults and removes access when someone leaves. Name a second person as a backup.
Plan the shared vaults
Personal vaults hold what only one person needs. Shared vaults hold what a group needs. Keep the structure simple:
- One shared vault per team, for example Finance, Marketing, Operations.
- One vault for company-wide accounts, such as the domain registrar, hosting or the company bank portal. Only a few named people can see this one.
- One owner per vault, who decides who may join.
Give people the lowest access that does the job. Most users only need to read and use a password, not edit or share it. This follows the same idea as in access in an internal tool: who may do what and how to review it every quarter.
Switch on two-factor
Two-factor authentication means that a password alone is not enough to log in. Turn it on in two places:
- For the password manager itself. This is the most important account in the company. Require two-factor for every user from day one.
- For the accounts stored inside, starting with email, banking, the domain registrar and cloud services.
An authenticator app or a hardware key is better than text messages. Ask people to store their recovery codes in a safe place, not in the same vault.
The two-week plan
Days 1–2: set up. Choose the product, create the company account, invite the owner and backup, create the empty vaults and write a one-page rule sheet (see below).
Days 3–5: pilot. Three or four people from different teams move their own passwords and the shared ones for their team. Note every question they ask and add the answers to the rule sheet.
Week 2, first half: everyone. Invite the rest. Run a 30-minute session where people install the browser extension and the phone app and import their existing passwords. Do it together, because homework rarely gets done.
Week 2, second half: clean up. Delete the old spreadsheet and chat messages with passwords. Replace the weakest or reused passwords, starting with the accounts that matter most. Check that nobody still keeps a copy somewhere else.
The one-page rule sheet
Keep it short. It should answer:
- What goes into the manager (all work logins) and what does not.
- Which vault to use for what.
- Never send a password by email or chat; share the vault entry instead.
- Use generated passwords, one per account.
- Who to ask for help and who to tell when a device is lost.
When someone forgets the master password
Decide this before the launch, because the answer depends on the product. Some products can reset access through an administrator, others cannot recover the data at all by design.
- Find out which of the two applies to your product.
- If a reset is possible, write down who may approve it and how the person's identity is checked.
- If it is not possible, make sure every user has a recovery kit or code stored safely, and that shared vaults have at least two owners so the company data is never locked.
When someone leaves
Add the password manager to the leaving checklist, next to email and building access (see the new employee access checklist, from day one accounts to day last removal). Remove the person's access on the last day. Then change the passwords of the shared accounts that person could see, starting with the most important ones.
Common mistakes
- Giving the manager only to IT or management.
- Shared vaults without an owner.
- No two-factor on the manager itself.
- Keeping the old spreadsheet "just in case".
- Having only one administrator.
- Not agreeing in advance what happens after a forgotten master password.
Summary
A password manager rollout is mostly organisation, not technology. Give it to everyone who logs in, build shared vaults with owners, turn on two-factor for the manager, follow a two-week plan and agree on recovery rules before launch. Then include it in the checklist for people who leave.
Sources
- Our related articles linked above.
- The approach described here is common practice for small and mid-sized companies, used as a practical guide and not as a formal standard. Product details differ, so check your chosen product's documentation for its recovery options. No client results or market figures are claimed in this article.
