Company passwords: one password manager and two-factor login for the whole team

Ask a small company where its passwords are and you usually get one of three answers. A spreadsheet called "parole" on the shared drive. A notebook in the director's drawer. Or "everyone knows it", which is how the Facebook page, the hosting account and the supplier portal tend to work.

It holds up until someone leaves. Then nobody is sure which accounts that person could open, which passwords they set themselves, and whether the old ones still work.

And a password is still the most common way in. In Verizon's 2025 Data Breach Investigations Report, stolen or misused credentials were behind 22% of the breaches it examined, more than software vulnerabilities or phishing.

What the rules say now

The advice most offices still follow (eight characters, a capital letter, a symbol, a new password every 90 days) has been dropped by the people who wrote it. The current NIST guideline, SP 800-63B-4, says:

• A password that is the only thing protecting an account must be at least 15 characters long.
• Systems should not demand a mix of capitals, digits and symbols.
• Systems should not force a change every few months, only when there is a sign the password has leaked.
• New passwords should be checked against lists of common and leaked ones.
• Password managers, autofill and pasting a password must be allowed.

Fifteen characters per account, all different: nobody remembers that. Which is the point: the person shouldn't have to. The manager remembers.

Step 1: make the list

Before installing anything, write down what the company logs into and who holds the keys. Most small firms are surprised by the length.

• Email, for every person and every shared address
• The domain registrar and the hosting
• Online banking and payment systems
• Facebook, Instagram and other business pages
• The CRM, the accounting software, the tax and invoicing portals
• Supplier and marketplace portals, the courier, the Wi-Fi router

For each line, note who is responsible for the account. That may well be someone other than the person who knows the password. Accounts with no owner are the ones that stay open for years after the person who made them has left.

Step 2: one password manager for the team

A team password manager is a vault each person opens with their own master password. Inside it you create shared folders by role: accounting sees the bank and the tax portals, marketing sees the social pages, the director sees everything. Nobody needs to know a password to use it, so nobody can carry it out the door.

Bitwarden, 1Password and Proton Pass all have plans for teams. Whichever you pick, check five things:

1. Shared folders with separate access for each person.
2. Removing a person cuts their access to everything shared, in one step.
3. The vault itself can be protected with two-factor login, and you turn that on.
4. You can export the whole vault, so you're never locked in.
5. It has a browser extension and a phone app, or people will go back to the spreadsheet.

Then move the passwords in, change each one to a long random one as you go, and delete the spreadsheet. Really delete it, including the copy in the email someone sent themselves in 2021.

Step 3: two-factor login, starting with email

Two-factor login (2FA) asks for a second proof after the password: a code from an app, a tap on the phone, or a physical key. A stolen password on its own is no longer enough. CISA, the US cybersecurity agency, puts it plainly: any second factor is better than none.

Turn it on in this order, because each one protects the next:

1. Email. Whoever controls the mailbox can reset almost every other password.
2. The domain and the hosting. Lose those and you lose the site and the email together.
3. Banking and payments.
4. The business pages on social networks.
5. Everything else on the list.

Not all second factors are equal. A passkey or a hardware key is the strongest, because it simply won't work on a fake login page. An authenticator app is the sensible default for everything that offers one. SMS codes are the weakest option: still better than nothing, but a SIM swap can redirect them.

Each service gives you recovery codes when you turn 2FA on. Don't keep them next to the passwords. Print them and put them in the safe, or in a separate vault that only the account owner can open.

When someone leaves

With the list and the manager in place, it takes about ten minutes:

1. Remove the person from the password manager.
2. Change the passwords of the shared accounts they used.
3. Take their phone off the 2FA of company accounts.
4. Move their mailbox to an alias or a colleague so client messages keep arriving.

A week is enough

For a team of five to twenty people this takes a few days: one day for the list, a couple of days to set up the manager and move everyone in, the rest to turn on 2FA account by account. The hard part is the list, and only the company can write it.

Setting this up, and keeping it up when people join and leave, is part of our maintenance and support service. If you would like help with your own list, write to us.