Choosing a company password manager: what actually matters
If a small business makes one security change this year, it should be a company password manager. Most breaches at small organisations start with a reused or guessed password, and a password manager removes the reason people reuse them: it remembers everything, so nobody has to.
The difficulty is not deciding to get one. It is choosing between a dozen products that all claim the same features, and then rolling it out so that people actually use it. This is what we look for when we set one up for a client, and the mistakes we most often clean up afterwards.
What actually matters when choosing one
Business accounts, not personal ones. A business plan lets you see who has access to what, share logins with a team without sending them by text or email, and, most importantly, take access back the day someone leaves. With personal accounts the company’s passwords walk out the door with the employee. If staff already use personal vaults, most business plans will let them keep a linked personal vault at no cost, which makes the move an easy sell.
Recovery that does not depend on one person. Make sure at least two administrators can recover access, and that the emergency recovery kit is printed and stored somewhere physical. A vault that only the owner can open is a continuity risk; we have been called in more than once because the one person with the master password was unreachable.
Sign-in protection. Require two-step verification for the password manager itself. It holds the keys to everything else, so it should be the hardest account in the business to get into. Hardware keys or an authenticator app are both fine; text-message codes are better than nothing but should not be the long-term answer.
Single sign-on if you already have it. If your business runs on a central identity platform, choose a password manager that can sign in through it. One account to disable on a leaver’s last day is better than two.
Easy enough that people use it. The best tool is the one staff actually use. Browser extensions and phone apps that fill in logins automatically matter more than a long feature list. Try the extension on the sites your team uses most before you buy; a few older line-of-business portals do not play well with autofill, and it is better to know that up front.
Reports you will read. A good business plan flags weak, reused and exposed passwords, and tells you which staff have not finished setting up. Someone should look at that report monthly. The number of reused passwords on the first day is often startling; watching it fall over the first quarter is how you know the rollout is working.
Shared vaults by team, not one big pile. You want a finance vault, an operations vault, a marketing vault, and so on, each shared with the people who need it. A single shared folder that everyone can see defeats the point.
What to avoid
- Spreadsheets and shared documents of passwords, however well protected. They are copied, emailed and forgotten about.
- Relying on the browser’s built-in password saving across a team. It is fine for one person and hard to manage for ten, and there is no way to revoke it when someone leaves.
- Buying a plan and never setting up the sharing vaults. Half-adopted is where most rollouts stall, and a half-adopted password manager gives you a false sense of security.
- Letting the owner be the only administrator. See recovery, above.
- Picking on price alone. The business tiers of the leading products are all inexpensive per user. The differences that matter are in administration and reporting, not in the monthly figure.
Rolling it out
- Start with the owners and managers, then the shared logins: bank, payroll, suppliers, domain registrar, email administration. These are the accounts where a lost or leaked password does the most damage.
- Set up the shared vaults by team before inviting everyone, so people arrive to something organised rather than an empty screen.
- Give staff a week to move their work passwords in, with a short walkthrough at the start. Fifteen minutes in a team meeting does more than any written guide.
- Then change anything that was ever written down, shared by email or kept in a spreadsheet. Moving an old password into a vault does not make it a good password.
- Add the password manager to onboarding and offboarding, so every new starter gets access on day one and every leaver loses it the same day. This is the single step most businesses skip, and it is the one that pays for everything else.
- Review the security report after the first month, and quarterly after that.
How long it takes, and what it costs
For a business of ten to thirty people, a proper rollout is a few hours of administrator time spread over two or three weeks, most of it in the first week. Business password managers are inexpensive per user, and the leading ones can be licensed through a partner for less than their published price. You can compare what several of them would cost your team on our software savings page, or talk to us about setting one up properly, including the vault structure and the offboarding step that makes it stick.