How do I set up a password manager for my team?

The short version

• Buy a business plan, so the company owns the account, not one employee.
• Name two administrators, so one person’s absence doesn’t lock everyone out.
• Organize shared passwords in vaults by job, like “Accounts,” “Website” or “Social media.”
• Move logins over one at a time, changing weak or reused passwords as you go.
• On someone’s last day, remove them and change the shared passwords they could see.

Why a business plan, not personal ones?

Our answer on managing business passwords explains why every business needs a password manager. CISA’s Secure Our World campaign lists “use multifactor authentication and a password manager” as one of its four steps.

The question here is how to set one up so it survives staff changes. A personal account belongs to the person. When they leave, the business passwords go with them. A business plan gives you an admin console, shared vaults, and the power to remove someone in one step.

What should I look for?

Compare current plans and prices on each provider’s own site. We don’t recommend a single brand here; the right one is the one your team will use.

A note on Microsoft Authenticator: Microsoft stopped its password autofill in July 2025, and saved passwords were no longer available in the app from August 2025. The app still works for sign-in approvals. If your team used it for passwords, those now live in the Edge browser, and a dedicated manager is the better home.

How do I roll it out?

Week one: set up.

1. Create the business account using a business email address.
2. Add a second administrator.
3. Protect both admin logins with a passkey or two-step login, and store the recovery details on paper in a safe place.
4. Create vaults by job, and decide who gets each.

Week two: move people over.

1. Hold a short session where everyone installs the app and browser extension.
2. Have each person move their work logins in, starting with email, then banking and accounting, then everything else.
3. While moving each one, replace weak or reused passwords with a long generated one. NIST’s authentication guidelines set a 15-character minimum for a password used on its own.
4. Turn on two-step login for each important account as you go.
5. Delete passwords saved in browsers and spreadsheets once they’re in the manager.

From then on: new logins go straight into the manager, and nobody emails or texts a password.

What happens when someone leaves?

1. Remove them from the password manager.
2. Check which shared vaults they could open.
3. Change those passwords, starting with money and email.
4. Remove their own logins from the services themselves. Our help on sharing logins safely covers this.

This is the step that pays for the whole setup. Without a manager, you’re guessing what they knew.

What are the common mistakes and edge cases?

• One admin. If they leave or are ill, nobody can recover accounts.
• Putting the manager’s own recovery codes inside the manager. Keep them on paper too.
• Sharing a whole vault with a vendor. Give them only the one login they need, or better, their own account. See vendor access.
• Personal and work mixed together. Most business plans give each person a private vault too. Keep work logins in shared vaults the business controls.
• Forced password changes every 90 days. NIST no longer recommends routine changes. Change a password when there’s a reason.

What if people won’t use it?

Make it easier than the old way. Show how autofill saves typing, and how the phone app fills in passwords too. Ask what’s getting in the way. Our guide to training staff has ideas.

How much does it cost, and how long does it take?

Business plans are usually priced per user per month; check current prices with each provider. The rollout takes about two weeks of short sessions for a small team, and an hour of the administrator’s time each week after that at first.

How does E-3 handle this?

Accounts E-3 sets up are created in the client’s name, with E-3 added as a user, so the login belongs to the business and can sit in its own password manager. Never email a password to anyone, including us.

Related questions

• What are passkeys, and should we use them?
• What should I ask a vendor before giving them access?
• How do I write a one-page security plan?
• Should I turn on two-factor authentication?
• Back to cybersecurity basics

Sources

1. Secure Our World (CISA)
2. SP 800-63B-4, Digital Identity Guidelines: Authentication (NIST)
3. Changes to Microsoft Authenticator autofill (Microsoft Support)
4. Cybersecurity for Small Business (Federal Trade Commission)