Email, cloud & backup
How should a team share passwords safely?
Every small business has a few shared logins: the supplier portal, the social media account, the Wi-Fi, the courier account. They often live in a spreadsheet, a sticky note or a group chat. When someone leaves, nobody changes them. A team password manager fixes this in an afternoon.
The short version
Better habits
- Give people their own accounts wherever a service allows it.
- Store genuinely shared logins in a team password manager.
- Share by group or role, not individually.
- Change shared passwords when someone leaves.
Why spreadsheets and chats are risky
- Anyone who ever saw the file or chat still has the passwords.
- Files get copied, emailed and synced to personal devices.
- There’s no record of who used which login.
- Passwords rarely get changed, especially after staff leave.
Step 1: Reduce shared logins
The best shared password is one that doesn’t need to exist.
- Social media: add each person as an admin with their own account through Meta Business Suite or the platform’s team features.
- Business software: most CRM, accounting and cloud tools let you add individual users. The extra seat cost is usually worth it.
- Email: use shared mailboxes accessed through people’s own accounts rather than a shared password for info@.
Individual accounts mean you can see who did what and remove one person without affecting everyone.
Step 2: Use a team password manager
For logins that genuinely must be shared, use a business password manager such as Bitwarden, 1Password, Keeper or Dashlane. They let you:
- Create shared vaults or collections for teams, like “Accounts” or “Marketing”
- Give access by group, so new staff get the right logins automatically
- Remove someone’s access in one step
- See who accessed what, on business plans
- Store two-step verification codes and notes alongside the login
Setting it up
Choose a business plan
Personal plans aren’t designed for shared business use or offboarding.
Create vaults by role
Group logins by who needs them, rather than one big shared vault.
Move logins in, then clean up
Import or add each login, change the password to a new generated one, and delete the old spreadsheet or chat history.
Protect the password manager
Require MFA for every user. Have at least two admins.
Build it into onboarding and offboarding
New starters get added to the right groups. Leavers are removed, and shared passwords they knew get changed. See onboarding and offboarding.
Shared accounts need two-step verification too
Many password managers can store and generate the authenticator code for a shared account, so the whole team can sign in securely without passing codes around by text.
Common questions
Can staff see each other’s personal passwords?
No. Team password managers keep personal vaults private. Only shared vaults are visible to the groups you choose.
What about the Wi-Fi password?
Put it in the shared vault, use a separate guest network for visitors, and change it occasionally, especially after staff leave.
Isn’t a password manager a single point of failure?
It’s a strongly protected one, with encryption and MFA. That’s far safer than a spreadsheet, and business plans include recovery options.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.