What Is the Most Secure Way to Share Passwords with Employees?
Every business has passwords that more than one person needs: the company social media accounts, a supplier portal, the Wi-Fi, the website. How you share them matters. A password sent by email or text can sit in inboxes for years, and a spreadsheet of logins is a gift to anyone who gets into your network.
The ways not to share passwords
- Email and text messages: they stay in sent folders, get forwarded and are searchable by attackers who get into an account.
- Spreadsheets and Word documents: easy to copy, hard to control, and rarely updated when staff leave.
- Sticky notes and whiteboards: visible to visitors, cleaners and anyone on a video call.
- Chat apps: messages in Teams or WhatsApp often stay forever and sync to personal phones.
The secure way: a business password manager
A business password manager stores passwords in an encrypted vault. Staff get access to shared folders, or “collections”, based on their role, and the password manager fills logins in for them. Well-known options include Bitwarden, 1Password and Keeper.
A password manager gives you:
- Sharing without revealing: staff can log in without ever seeing the password, if you choose.
- Control: give or remove access to a shared folder in seconds.
- Strong, unique passwords for every account, generated automatically.
- A record of who accessed what, and when.
- Alerts for weak, reused or breached passwords.
How to set it up in a small business
- Choose a business plan, not personal accounts, so the business owns the vault.
- Protect the vault with MFA and a strong passphrase. See our guide to MFA.
- Create shared folders by role, for example “Marketing”, “Accounts” and “Admin”.
- Move shared passwords in, then change each one as you go, because the old ones may have been exposed in emails.
- Delete the old spreadsheet, and search your email for any remaining copies.
- Add the password manager to your onboarding and offboarding checklists.
When someone leaves
Remove their access to the password manager on their last day. Then change the passwords they could see for critical accounts such as banking, admin and social media. A password manager makes this a 15-minute job instead of a guessing game.
Better still: avoid shared passwords where you can
Many services now let you add individual users instead of sharing one login, including Microsoft 365, Xero, Facebook Business and most supplier portals. Individual accounts with MFA are safer, and you can see who did what.
For more on choosing good passwords, read our complete guide to strong passwords.
What about the Wi-Fi password?
The office Wi-Fi password often ends up on a sticky note or shared with every visitor. A better setup is a separate guest network for visitors and personal devices, with its own password that is changed regularly, and a staff network that only business devices can join. Many routers can show the guest password as a QR code, so you never need to read it out.
Plan for emergency access
What happens if the only person who knows a critical password is on leave, unwell or has left the business? A password manager solves most of this, because access is shared by role rather than held by one person. Most business password managers also offer emergency access features. For Microsoft 365, keep a separate “break-glass” administrator account with a very strong password, stored securely and used only in emergencies, so you can never be locked out of your own systems.
Choosing a business password manager
When comparing options, look for:
- An admin console so the business, not individual staff, controls the vault
- Shared folders or collections that can be assigned by team or role
- MFA, and ideally single sign-on with Microsoft 365
- Activity logs showing who accessed which passwords
- Simple offboarding that removes a user’s access in one step
- Browser extensions and mobile apps your team will actually use
- Reports on weak, reused and breached passwords
Common questions
Is a web browser’s built-in password manager enough for a team?
For one person it is better than nothing, but browser password managers are designed for individuals. They don’t give the business control over shared passwords, an audit trail or a clean way to remove access when someone leaves.
What if the password manager company is hacked?
Reputable business password managers encrypt your vault so that the company itself cannot read your passwords. Breaches at password manager companies have happened, which is why a strong master passphrase and MFA on the vault are essential. Even so, the risk is far lower than passwords sitting in emails, chat messages and spreadsheets.
Should we share MFA codes for shared accounts too?
Where a shared login can’t be avoided, many password managers can store the MFA code alongside the password so authorised staff can sign in without passing a phone around. The better long-term fix is to replace shared logins with individual accounts wherever the service allows it.
Want a business password manager set up properly? See our managed IT security services.
Want a password manager set up for your team?
We set up business password managers, move your shared logins across safely and train your staff.
Or call 1300 133 770.
