Password manager for a small business: choosing one and when an employee leaves

The email password on a sticky note by the monitor, a “Passwords.xlsx” spreadsheet on the shared drive, the same password for three services. Sound familiar? In a small business this is everyday reality, and it usually ends one way: someone leaves, and you don’t know what they had access to.

In this guide I show how to choose a password manager, roll it out in one evening and what to do when an employee leaves. I write in general terms, without price tables, because vendors’ plans change often.

Why not a spreadsheet or sticky notes

A spreadsheet looks like a sensible solution, but it has several drawbacks that only show up in a crisis:

• There’s no full history. You usually can’t see who opened the file and who copied the passwords.
• You can’t revoke access to a single password. Either someone sees the whole file or nothing.
• The file travels. It ends up in emails, on USB drives, on personal phones and in backups.
• The passwords are in plain view. Anyone who opens the file sees everything, and while the file is open, so does a customer looking over your shoulder.
• It encourages simple passwords. When people have to type passwords in by hand, they choose short and repetitive ones.

A sticky note by the monitor has one advantage: an attack from the internet can’t take it over. But every customer and every cleaner can see it, and once it’s lost or photographed, there’s no way to invalidate it.

What a password manager does

A password manager is an encrypted vault. You remember one long master password, and it generates and fills in the rest. For a small business, three things matter:

1. A unique, random password for every account, with no inventing and no reusing.
2. Shared vaults for the team: access to a company account without sending the password by email.
3. Access control: you add and remove people with one click.

A password manager won’t replace common sense. If someone types a password on a fake website, the vault won’t help. A good password manager does have one advantage, though: it won’t suggest a password on a site with a different address, which in itself stops some phishing attempts.

How to choose: Bitwarden, 1Password or the manager from your account

There’s no single best tool. The choice depends on the number of people and on whether you need shared vaults.

My practical rule: one person, a few accounts means the password manager built into the account you already have. Two or more people, shared email, ads, a domain means a separate password manager for businesses, such as Bitwarden or 1Password. Choose one and don’t mix: when half the team uses Google and the other half Apple, nobody knows where which password is.

Master password and 2FA: two safeguards for the vault

A vault is only as secure as its key. That’s why:

• The master password should be long, ideally 4–5 random words. Don’t use it anywhere else.
• Don’t save it on your phone or in email. Write it on a piece of paper and keep it at home or in a physical safe. That’s the only good reason to use paper.
• Turn on a second factor (2FA) for the password manager account: an authenticator app or a hardware key. SMS is better than nothing, but weaker.
• Turn on 2FA for your most important accounts too: email, domain, hosting, bank, ad account.
• If the password manager supports passkeys, use them wherever the service supports them.

Rollout in one evening

A plan you can carry out without an IT specialist:

1. Choose the tool and create the owner’s account. Set up the master password and 2FA.
2. Create vaults (collections) by department, e.g., “Email and domain”, “Ads and social media”, “Finance”, “Store and hosting”.
3. List the company accounts: email, domain, hosting, website dashboard, Google (Analytics, Business Profile, Ads), Meta, bank, accounting, software.
4. Change the passwords to generated ones. Start with email and the domain, because everything else is reset through email.
5. Invite employees and give them access only to the vaults they need.
6. Delete the spreadsheet and the sticky notes. Only once you have moved everything over.
7. Set up a second administrator or emergency access (see below).

The same rule applies to the domain and hosting: the account should be registered to the company, not to an employee’s private address. I write about this in the guide on regaining access to your website from an agency.

Shared vaults: who sees what

A shared vault solves the “only Kasia has the Facebook password” problem. A few rules:

• Give the minimum access. A salesperson doesn’t need online banking, and the accountant doesn’t need the ad account.
• Separate roles. The administrator manages people, a regular user uses the passwords. Where possible, give read-only access.
• Don’t send passwords by email or messenger. Share the entry in the vault.
• Company accounts, not personal ones. If a tool lets you add another user (e.g., in Google Ads or Meta), add the person instead of sharing one password. That way you know who did what.

For accounts that don’t have separate users, a shared password in the vault is a good solution, but remember 2FA: the code then goes to one person. Some password managers can store one-time codes together with the password, which makes teamwork easier, but it’s worth weighing that consciously.

Emergency access: when the owner can’t be reached

An accident, an illness, a vacation with no cell coverage. If the only person with the master password can’t be reached, the company loses access to everything. That’s why:

• Set up a second administrator in the organization, ideally a person you trust who has their own 2FA.
• Use emergency access if the tool offers it: a trusted person can request access and gets it after a set time if you don’t object.
• Write down recovery instructions and keep them in a sealed envelope with a trusted person or in a safe.
• Test it once a year: check that the second administrator can really log in.

When an employee leaves: a checklist

This is the most important part. Do it on the day the person leaves, and if there’s a conflict, even before the conversation.

1. Revoke access to the vault and remove the user from the organization.
2. Change the passwords to the accounts they knew, starting with the most important ones: company email, domain, hosting, bank, ad accounts, social media, website dashboard. Removing the account from the password manager doesn’t change passwords that someone has already seen or copied.
3. Reset 2FA on shared accounts if the codes went to their phone.
4. Remove them from accounts that have separate users: Google, Meta, hosting, the store system, accounting.
5. Forward their email to the person in charge and disable sign-in to their account.
6. Check signed-in devices and active sessions on important accounts.
7. Collect the equipment and remotely sign their phone out of company apps.
8. Write down the date and scope of the changes in one note. It will come in handy in a dispute and during an audit.

If you change the passwords to your website or store after someone with access to the dashboard leaves, also check the list of administrators and plugins. I do the same with a hacked WordPress site.

What not to do

• Don’t keep recovery codes in the same vault as the master password.
• Don’t use one password manager account for the whole company. Everyone has their own.
• Don’t save passwords in the browser of an employee’s personal computer if the hardware isn’t company-owned.
• Don’t share the whole vault “for convenience”.
• Don’t put off changing passwords “until later” after an employee leaves.

Summary

A password manager is one of the cheaper and more effective changes in a small business: unique passwords, shared vaults and order when an employee leaves. Start with email and the domain, turn on 2FA and set up emergency access.

If you want to check whether your website and forms can withstand password guessing and bots, order a security audit or write to me. To get started, you can also use the free Check your website tool, which checks security and domain settings, among other things.