Contents6
The day an employee leaves, someone asks the awkward question: “what did she have access to?” Without a password manager, the answer is pieced together from memory, by digging through email, a shared spreadsheet and chat threads. With a team password manager, it fits on one screen.
This guide from our Infrastructure and cloud section explains what a password manager changes for a team of 20 to 500 people, how to choose one without favouring any vendor, and where to start.
In short
A team password manager replaces the spreadsheet, the chat messages and the sticky notes with an encrypted vault, shared by role.
Joining and leaving become short steps: you grant or remove access to a group.
It makes possible what official guidance asks for: a long, unique password per account, with no forced changes on a fixed schedule.
Two-factor authentication remains essential, on the vault itself first.
Hosted by the vendor or installed on your own server: both are defensible, and the deciding factor is your ability to run it.
Why team passwords end up everywhere
Because a shared login has to travel, and the shortest route wins. The hosting account goes through a message, the company’s social media login through a sticky note on the reception screen, the shop’s admin access through an “Access” spreadsheet that everyone ended up opening. Nobody chose this system: it set itself up.
The result shows the day you need to act fast. A suspicious account, a departure, a change of contractor: nobody knows who knows what any more, and changing a shared password breaks the work of everyone who was using it without anyone knowing.
ANSSI, the French national cybersecurity agency, settled the question in its recommendations on authentication and passwords:
Use a password vault.
CNIL, the French data protection authority, takes the same line: its 2022 recommendation on passwords lists the password manager among good practices for creating and renewing passwords.
What a password manager changes, from the first day to the last
The most visible benefit is not technical: it is the time saved at the moments when a team changes.
The life of a login in a team password manager
- Joining
The employee joins a group and receives the logins for their role in one go.
- Sharing
A new login is stored once, in the right folder, not in a message.
- Changing
A changed password is up to date for everyone who uses it.
- Leaving
You remove the person from the group, and you know which logins to change.
Joining: a group rather than a list
You no longer hand out logins one by one: you put the person in their group (sales, accounting, marketing), and they inherit what their job needs. The day a tool is added to the role, the whole group receives it.
Leaving: the awkward question has an answer
The password manager tells you which passwords the person could read. Removing their access to the vault is not enough, because what they have seen they may still remember: the sensitive logins they used get changed, and the password manager tells you which ones. The same logic applies to a contractor who leaves.
Day to day: long, unique passwords at last
Nobody remembers forty different twenty-character passwords. A password manager does: it generates them, fills them in and keeps them. That is what makes current rules workable. NIST, the US standards institute whose guidance serves as a reference far beyond the United States, revised its own in version 4 of its authentication guideline:
- a password used on its own must have at least 15 characters;
- periodic changes are no longer forced, only when an account is compromised;
- each new password is checked against a list of common or already compromised passwords;
- services must allow password managers and autofill.
Key takeaway
Security no longer comes from complexity imposed on people, but from length and uniqueness, which only a password manager makes practical.
How to choose: hosted by the vendor or installed on your server
Both families exist, with serious products on each side. Password managers hosted by their vendor (1Password, Bitwarden, Dashlane, Keeper, Proton Pass, among others) can be up and running in a day. Others can also be installed on your own server: Bitwarden publishes the procedure for hosting it on a Linux server, and open source options such as Passbolt or Vaultwarden follow the same path.
Hosted by the vendor
Running the same day, with no server to maintain
Updates and availability handled by the vendor
Per-user subscription, which grows with the team
Installed on your server
The encrypted vault never leaves your infrastructure
Updates, backups and monitoring are your job
Cost of the server and of running it, not per user
Whichever you choose, four criteria decide:
- encryption happens on the device, before anything is sent to the server: the vendor or host must not be able to read the vault;
- sharing by groups and folders, and a log of who viewed what;
- sign-in through the company directory when you have one, so that a disabled account also closes the vault;
- emergency access: the procedure for recovering critical logins if the only person who held them is unavailable.
Installing the vault yourself only makes sense if someone keeps it updated, backed up and monitored: it is a critical service, since it opens all the others. Our article on which tools to move out of SaaS first helps place the password manager in that order of priority.
Watch out
The vault that opens everything gets protected first
The password manager’s master password is stored nowhere but in its holder’s head, and two-factor authentication goes on the vault before any other account. A vault protected by a short password and nothing else concentrates the risk instead of reducing it.
What we learned tidying up our own logins
From the field
The day we decided to run our agents in the cloud rather than on a computer, some of our keys still lived in a file on the founder’s machine: one machine failing, and nobody would have known where the keys were or which ones to change. On Palmora Property, a real estate portal we operate, it was the same dependency on a single machine that led to setting up a self-hosted secrets vault.
Both cases mix human passwords and technical keys. The distinction matters: the team password manager is for people, while API keys used by programs and AI agents belong in a secrets vault, which we describe in our article on the secrets vault. The risk specific to those keys, a bill that runs out of control, has its own article: stolen API keys, the overlooked risk of AI projects.
Where to start
- List your shared logins
Hosting, domain name, online banking, social media, shop, business tools. Note who uses them.
- Choose the password manager
Against the four criteria, and put two-factor authentication on the vault.
- Create groups by role
Then store each login in the folder of the group that needs it.
- Change the passwords that have travelled
By chat or spreadsheet along the way, then delete those copies.
- Write the leaving procedure
Remove from the group, then change the sensitive logins the password manager points to.
The password manager is part of the infrastructure foundation shared by your projects, along with named accounts, backups and monitoring. The rest of the section covers neighbouring decisions: the five items that inflate a cloud bill, dedicated server, VPS or cloud, Kubernetes and mid-sized companies, monitoring, the disaster recovery plan, NIS2 in France, backing up your own server, self-hosted n8n in production, the three-year cost of leaving SaaS, cloud migration without breaking things, dependence on the American cloud, the hardware to run an AI model yourself, managed or self-hosted Postgres and choosing a business email provider.
To install the password manager on your server alongside your other tools, backups and monitoring included, see our Leaving SaaS offer. For a simple scoping discussion, tell us about your team.
Frequently asked questions
Is a password manager really safer than a protected spreadsheet?
Yes. A spreadsheet gets copied, shared as a whole and says nothing about who read which line. A password manager encrypts each entry, shows each person only what concerns their role, keeps track of who viewed what and fills in login forms, which makes long, unique passwords possible for every account.
What happens if the password manager vendor is hacked?
If encryption happens on the device, the attacker gets encrypted vaults, unreadable without each user’s master password. That is why that password must be long and unique, and two-factor authentication switched on. As a precaution, then change the most sensitive logins first.
Do we still need to change passwords every 90 days?
No. The NIST guideline says periodic changes should no longer be imposed, and changes should only be forced when an account is compromised. A long, unique password checked against lists of already leaked passwords protects better than a short one changed every quarter.
Can API keys go into the same password manager?
For a few keys looked up by people, it is possible. As soon as programs, automations or AI agents use them, a secrets vault is better suited: it supplies the key to the program at the moment of the call, without a person copying it, and it records every use.
Sources
- ANSSI, recommendations on multi-factor authentication and passwords, October 2021 (new tab)messervices.cyber.gouv.fr
- CNIL, passwords: a new recommendation, October 2022 (new tab)cnil.fr
- NIST SP 800-63B-4, Authentication and Authenticator Management (new tab)pages.nist.gov
- Bitwarden, Install and Deploy: Linux (new tab)bitwarden.com
ANSSI, recommendations on multi-factor authentication and passwords, October 2021
Read on messervices.cyber.gouv.fr(new tab)NIST SP 800-63B-4, Authentication and Authenticator Management
Read on pages.nist.gov(new tab)Jim · founder of Brain Plus AI
Also in infrastructure and cloud
Understand12 min
Secrets vault: your AI uses your keys without seeing them
Passwords sent by email, API keys forgotten in code, AI agents that could copy everything: these are the leaks we come across most often. And how a vault in your name lets your AI use your keys without ever reading them.
Understand8 min
Stolen API keys: the overlooked risk of AI projects
An AI project multiplies API keys, and each one, once stolen, becomes a bill someone else runs up at your expense. Where they leak, how to limit the damage before the leak, and what to do in the first hour.
Practical guide13 min The topic guide
Cloud infrastructure: the foundation for all your projects
Before the first project, a cloud infrastructure foundation settles accounts, access, backups and budget once and for all, and every later project inherits it. What it contains, where to put it, what it costs and why running it matters more than installing it.