Every small business runs on logins. The bank, the accounting software, the domain registrar, the social media accounts, the supplier portals, the Wi-Fi, the server and the API keys that connect it all together. In most small teams those passwords live in a mix of places: a spreadsheet on the shared drive, a sticky note by the till, a chat message from two years ago and the memory of whoever set the account up.
That works until it does not. Someone leaves and nobody knows which passwords they had. A password reused across ten accounts turns up in a breach. The one person who knows the bank login is on holiday on the day a payment has to go out. This guide explains how to manage passwords as a team, from the habits that matter most to a simple routine for sharing, reviewing and changing them.
The short version: give every account its own long password, keep them all in a password manager instead of spreadsheets and chat, share each login only with the people who need it, switch on two-step verification wherever you can and change shared passwords when someone leaves.
Why team passwords go wrong
Personal password habits are hard enough. Teams add a second problem: the same login is needed by several people, so it gets copied around. Each copy is another place it can leak from, and none of them tell you who has seen it.
- Reuse. When one website is breached, the stolen email and password pairs are tried against everything else. A reused password turns somebody else's breach into yours.
- Sharing in plain text. A password sent in chat or email stays in that message, on every device it synced to, long after the person who needed it has moved on.
- Spreadsheets. A shared spreadsheet of logins is easy to copy, easy to forward and rarely locked down. Anyone who can open the folder can read every password in it.
- Single points of knowledge. When only one person knows a login, the business depends on them being reachable. When they leave, the account can be lost entirely.
What a good team password looks like
The UK National Cyber Security Centre recommends making passwords long rather than complicated. Three random words joined together are far stronger than a short string of symbols and much easier to type. For accounts that only a password manager will ever fill in, let it generate a long random password instead. Nobody needs to remember it.
What matters most is that every account has its own password. A strong password used in two places is only as safe as the weaker of the two sites.
Use a password manager
Nobody can remember dozens of unique passwords, and a team cannot share them safely by hand. A password manager solves both problems. It stores every login in one encrypted place, generates new passwords, fills them in for you and lets you share an entry with a colleague without the password ever being written down or pasted anywhere.
When you choose one for the team, look for these things:
- A separate master password. The vault should be locked behind its own password, not only your normal sign in, so a stolen session is not enough to read it.
- Automatic locking. It should lock itself when you step away from your desk.
- Sharing with roles. You should be able to share one entry with one person and decide whether they can only use it or also change it.
- More than website logins. Teams also hold API keys, server keys, database connections and cloud credentials. These belong in the vault too, not in a text file on someone's laptop.
- A browser extension. If filling in a password takes longer than typing it, people will stop using the manager.
Decide who needs what
Not everyone needs every password. Before you move logins into a shared vault, sort them into three groups.
- Personal logins. Each person's own email, their own accounts and anything tied to them alone. These stay private to that person.
- Shared logins. Accounts several people genuinely use, such as the social media accounts, a supplier portal or the shop's admin panel. Share each one only with the people who use it.
- Critical logins. The bank, the domain registrar, the email administrator account and the main cloud account. Keep these with as few people as possible, but never with only one. Two trusted people is a sensible minimum, so the business is never locked out.
Where a service lets you give each person their own account instead of sharing one login, do that. Individual accounts can be removed one at a time, and the service can tell you who did what. Shared logins are for the cases where that is not possible.
Share passwords safely
Once your logins are in a password manager, make it the only way passwords change hands. Agree a simple rule with the team: if a password is needed, share the vault entry. Never paste it into chat, email or a document.
Give the least access that does the job. Most people only need to use a login, not to edit it or pass it on. Keep the right to change or re-share an entry with the person responsible for that account, and remove a share as soon as someone no longer needs it.
Add two-step verification
A password on its own is one lock. Two-step verification adds a second, usually a code from an authenticator app or a text message, so a stolen password is not enough to get in. Switch it on for every account that offers it, starting with email, banking and anything that can reset other passwords.
Shared accounts make this awkward when the code goes to one person's phone. Where a service uses an authenticator app, store the setup secret in the password manager with the login, so the people who share the account can set up their own authenticator app without depending on one phone.
A routine for joiners and leavers
Most password trouble starts when people join or leave. Make both part of your normal process.
- When someone joins, set up their vault on day one and share only the entries their role needs. Our employee onboarding checklist covers the rest of their access.
- When someone leaves, deactivate their accounts on their last day, remove their shares and change every shared password they knew. Start with the critical logins.
- When someone changes role, review their shares and take back anything they no longer need.
Review and rotate
The NCSC no longer recommends changing passwords on a fixed schedule for its own sake, because forced changes tend to produce weaker passwords. Change a password when there is a reason to: someone who knew it has left, it may have been exposed, or the service reports a breach. Some credentials do have a natural end date, such as API keys and access tokens that expire. Record those dates with the entry so they do not catch you out.
Once a quarter, spend half an hour on a quick review. Check who has access to the critical logins, remove shares nobody uses and look for entries that still share a password.
Mistakes to avoid
- Keeping the old spreadsheet. Once logins are in the vault, delete the spreadsheet and any copies. Two places means two places to leak from.
- One person holding the keys. Make sure at least two trusted people can reach every critical account.
- Forgetting the master password. A good vault cannot recover it for you. Choose one you will remember and keep a written copy somewhere physically safe.
- Skipping the technical secrets. API keys, SSH keys and database passwords are often the most powerful credentials a business holds. Store them in the vault too.
- Not changing passwords when people leave. Removing someone's account does not change a password they already know.
How this works in Wizard Application
The password vault in Wizard Application is built for exactly this. Each person sets up their own vault with a master password and an optional hint, and their entries are encrypted with their own master key. The vault locks itself after 15 minutes of inactivity, and you can lock it by hand whenever you step away. The master password cannot be recovered, so the only way back in without it is to reset the vault, which deletes everything in it.
Entries come in the types a business actually needs: logins, secure notes, API keys, AWS credentials, GitHub and personal access tokens, database connections, SSH keys and sets of environment variables. A login holds the web address, username and password, and you can store the two-factor setup secret with it so the people who share the account are not tied to one phone. A built-in generator creates strong new passwords, and any value can be copied with one click without being shown on screen. Put entries in folders, star the ones you use most and add an expiry date to credentials that need replacing.
To share an entry, add a team member with one of three roles. A viewer can only view it, an editor can view and change it, and an admin can also delete it and share it with others. Remove a share at any time. The browser extension connects to your vault with a token you create on the vault's extension page, then fills in your matching login on the sign-in page.
The vault is part of every plan, with the number of entries set by your plan. It sits alongside roles and permissions, so access to the rest of the workspace follows the same least privilege approach. You can read more about how we protect your data on our security page.
Frequently asked questions
Is it safe to keep all our passwords in one place?
Yes, if that place is a proper password manager. The vault is encrypted and locked behind a separate master password, which is far safer than passwords spread across spreadsheets, chat and sticky notes. Protect the master password, and ask your administrator to switch on two-factor sign in for the workspace.
How often should we change our passwords?
Change a password when there is a reason to, such as someone leaving, a suspected leak or a breach at the service. Changing strong unique passwords on a fixed timetable adds little and tends to make people choose weaker ones.
Should every employee have their own account instead of sharing one login?
Wherever the service allows it, yes. Individual accounts can be removed one at a time and show who did what. Use shared logins in the vault only where one account is the only option.
What happens if someone forgets their master password?
It cannot be recovered. The person can reset their vault, which deletes their entries, and anything shared with them can be shared again by its owner. That is why critical logins should always be held by at least two people.
What should we do when an employee leaves?
Deactivate their accounts on their last day, remove their vault shares and change every shared password they knew, starting with banking, email and your domain.
Passwords are only one part of keeping a small business safe. Our small business security guide covers the rest, from phishing to backups, and our guide to roles and permissions explains how to give people only the access they need.
