How to Roll Out a Password Manager for a Small Team

In most small offices the real password system is a spreadsheet called "logins", a sticky note under the reception keyboard and one person everyone asks when something stops working. It works until that person leaves, or until the spreadsheet is emailed to the wrong address. A password manager for a small team replaces all of that, but only if you roll it out in a way people will actually use.

I have helped a handful of teams between 4 and 25 people make this switch, from a dental practice to a small architecture studio. The software is the easy part. The rollout is where it succeeds or quietly fails. Here is a plan that takes about two weeks and does not need an IT department.

What a password manager for a small team should do

A personal password manager stores your own logins. A business version adds the features that matter when several people share accounts. Before choosing one, make sure it has:

• Shared vaults or folders. So the accounts team can share the bank login without everyone else seeing it.
• Admin controls. The ability to add and remove people, and to recover a vault if someone forgets their master password.
• Enforced two-factor authentication for every member, set by the admin rather than left to individuals.
• Browser extensions and mobile apps for every device your team uses, including any personal phones used for work.
• An activity log showing who accessed or changed shared items, which helps after an incident.
• Passkey support, since more services now offer them in place of passwords.

Expect to pay roughly £3 to £8 per user per month for a business plan from the well-known providers. For a team of 10, that is about £360 to £960 a year, which is less than one hour of an incident responder's time after a breach.

A two week rollout plan

Trying to move everyone and everything on one Friday afternoon is the most common reason these projects stall. Split it up instead.

Two people should have admin rights, never one. If your only admin is on holiday or leaves suddenly, the team can be locked out of everything.

Setting up shared vaults that make sense

Organise vaults around who needs access, not around what type of account it is. A practical layout for a 10 person business might be:

• Everyone: Wi-Fi password, printer admin, shared calendar, office alarm code.
• Finance: online banking, payroll, accounting software, HMRC or tax portal.
• Marketing: social media accounts, website admin, newsletter platform.
• Admins only: domain registrar, email admin console, the password manager's own recovery codes.

The admin-only vault is the one people forget, and it is the most important. Whoever controls your domain and email admin can reset nearly every other password in the business. If that account has ever been compromised, recovering a hacked email account step by step covers what to do first.

When you move each shared account into a vault, change its password at the same time to a new random one generated by the manager. The old password has been in a spreadsheet, so treat it as already exposed.

Why you should not force a master password policy

A common instinct is to set strict rules for the master password: 16 characters, symbols, changed every 90 days. I recommend against the rotation part, and against complex symbol rules in general.

Forced rotation of the one password people must memorise leads to predictable patterns like Spring2026! becoming Summer2026!, or worse, to the master password written on a sticky note. Current guidance from bodies such as the UK National Cyber Security Centre also advises against routine expiry. Instead, ask for a long passphrase of four or more random words, enforce two-factor authentication on the manager itself, and only require a change if you suspect it has been exposed. That combination is both stronger and easier to live with.

Getting people to actually use it

The rollout session on day five decides adoption more than any setting. A few things that consistently help:

1. Do it together, in the room or on one call. Everyone installs the extension and saves one real login before leaving. Nobody goes home with "I'll set it up later".
2. Show autofill first. People adopt a password manager when they see it saves them typing, not when they hear it is safer.
3. Allow personal use. Many business plans include a free personal vault. People who use it at home get fluent much faster.
4. Name a helper. One person, not necessarily technical, who answers "how do I" questions for the first month.

For the broader set of habits this fits into, security a small team can actually follow covers the other basics worth doing alongside it.

When someone leaves

This is where a password manager pays for itself. On an employee's last day, remove them from the business account, which instantly revokes access to every shared vault. Then check the activity log for any shared items they accessed in the last 30 days and change those passwords. Without a manager, the same job means guessing which accounts they knew. The full process is in offboarding an employee securely.

Frequently asked questions

Do small businesses need a password manager?

Yes, for most businesses with more than two or three people sharing accounts. It replaces spreadsheets and reused passwords, which are among the most common causes of small business breaches. It also makes removing a departing employee's access fast and reliable.

How much does a password manager cost for a small team?

Business plans typically cost £3 to £8 per user per month. A team of 10 would pay roughly £360 to £960 a year. Some providers offer discounts for annual billing or for charities.

Is it safe to store all company passwords in one place?

It is safer than the alternatives, as long as the manager uses end-to-end encryption and every user has two-factor authentication turned on. The provider cannot read your vault contents. The main risk is a weak master password, which a long passphrase plus 2FA addresses.