Does a small business need a password manager?

The problem a password manager solves

A typical office worker has dozens of logins: Microsoft 365, the accounting system, the bank, supplier portals, the courier account, social media, industry websites and more. Nobody can remember that many strong, different passwords, so people do what's natural. They reuse one or two favourites, write them in a notebook, keep them in a spreadsheet called 'passwords', or let the browser remember them.

Reuse is the real danger. When any website suffers a data breach, its passwords end up in lists that criminals try against other services automatically. If a staff member used the same password for a shopping site and their work email, that breach becomes your breach, even though your systems were never touched.

How a password manager works

A password manager is an encrypted vault that stores passwords and fills them in for you. Each person unlocks their vault with one strong master password or passphrase, ideally combined with multi-factor sign-in or a fingerprint. The manager generates random passwords for new accounts and fills them into the right website automatically, so staff never need to see or type most of them. Because it only fills a password on the exact domain where it was saved, a good password manager also helps against phishing. If a fake Microsoft page doesn't trigger autofill, that's a useful warning sign that the page isn't genuine.

Business features that matter

Personal password managers are fine for individuals, but businesses need a few extra features. Shared vaults let a team share logins, such as the courier account or social media, without anyone sending passwords by email or chat. Admin controls let you require strong master passwords and multi-factor sign-in, and see which staff have set up their vault. Most importantly, a business version lets you remove a person's access when they leave and keeps the company's shared credentials in company hands. With personal tools or a notebook, the passwords walk out the door with the person, and you're left changing every shared login in a hurry.

What about the browser's built-in password saving?

Browsers like Edge, Chrome and Safari can save passwords, and that's far better than reuse. But browser storage is tied to an individual's account, sharing is limited, and the business has little visibility or control. If a staff member signs in to the browser with a personal account, work passwords may sync to their home devices.

For a sole trader, a browser's password manager with a strong account password and multi-factor sign-in may be enough. For a team that shares accounts and has staff come and go, a dedicated business password manager is usually worth the modest cost per user. Check current pricing, as plans change regularly.

Rolling one out without resistance

Start with the leaders. If the owner and managers use it first and talk about how much easier it is, staff follow. Set up shared folders for the logins teams actually share, so people see an immediate benefit. Install the browser extension and phone app for everyone, and show them how autofill works in a short session.

Don't try to move every password on day one. Ask staff to save each password into the vault the next time they use that site, and to change any reused ones as they go. Within a few weeks most accounts will be in the vault, and the old spreadsheet can be deleted.

Protecting the vault itself

A password manager concentrates your passwords in one place, so the master password and sign-in to the vault must be strong. Use a long passphrase of several random words that isn't used anywhere else, and turn on multi-factor sign-in for the vault. Decide what happens if someone forgets their master password, since some products can't recover it by design. Choose a reputable product with independent security audits and a clear record of handling problems openly. Avoid little-known free tools. Your IT provider can help compare options and set up the admin side so recovery, offboarding and policy settings are configured properly from the start.

Where password managers fit with passkeys and single sign-on

Many business apps can now use your Microsoft 365 or Google account to sign in, which means fewer separate passwords to manage. Passkeys, which replace passwords with a key stored on your device, are spreading too. Both are good news and reduce the number of passwords a password manager needs to hold. Even so, there will be supplier portals, government sites and older systems that still use passwords for years to come. Most good business password managers can now store passkeys as well, so a vault remains useful as the shift away from passwords continues.