BitFlip Technologies
Get in touchContact
Menu
Security Notes

Password managers for small teams

By Travis Baldwin, Founder & Principal ConsultantLast reviewed 2 min read

The short version

  • Every account needs its own long, random password. Reuse is how one breach becomes many.
  • A password manager creates and remembers those passwords, so people don't have to.
  • A business plan lets your team share logins safely, instead of in a spreadsheet or a text message.
  • Protect the manager itself with a long passphrase and two-step login.

The real problem is reuse

When a website is breached, its list of email addresses and passwords often ends up for sale. Criminals then try those same combinations everywhere else, automatically. If one password was used for a shopping site and for your business email, a breach at the shopping site becomes a break-in at your business.

You can check whether an email address has appeared in a known breach at Have I Been Pwned, a free service run by a security researcher.

What a password manager does

  • Creates strong passwords, long and random, for every account.
  • Remembers and fills them in on your computer and phone, so nobody has to type or memorize them.
  • Warns you about passwords that are reused, weak, or have appeared in a breach.
  • Keeps more than passwords, including backup codes and, in many cases, passkeys.

Choosing one

For one person, the password manager built into an Apple device or a Google account is a solid start. For a team, look for a business plan that adds:

  • Shared vaults, sometimes called collections, so people share only the logins they actually need.
  • Admin controls and account recovery, so a forgotten master password doesn't mean lost access.
  • Easy offboarding, so you can remove someone's access in one step.
  • Apps for every device your team uses.

Well-known options include Bitwarden and 1Password. We mention them as examples, not endorsements; several good products meet the list above.

Moving your team over

  1. Start with yourself. Set up the business account and use it for a week.
  2. Create shared vaults by role, such as Finance, Website and domain, and Social media, and put each login in the right one.
  3. Bring everyone on board together. Most managers can import passwords already saved in a browser.
  4. Change the most important passwords first, email, banking and payroll, to new generated ones.
  5. Retire the spreadsheet. Delete it once everything is in the manager, along with passwords saved in old emails or notes.
  6. When someone leaves, remove their access and change any shared passwords they knew.

Protect the key to the vault

Your master password is the one password you do need to remember, so make it long rather than complicated. A string of five or more random words is easier to remember and harder to guess than a short password full of symbols; CISA's guidance on strong passwords explains why length matters most.

Turn on two-step login for the password manager itself, and keep its emergency recovery details somewhere safe and offline.

More Security Notes