Every small team has the same dirty secret. The WiFi password is taped under someone’s desk. The Instagram login lives in a group chat from two years ago. The accountant’s portal still uses the same password you chose in 2019, and three former freelancers could probably still log in if they tried. If any of this sounds familiar, learning how to set up a password manager for a small team is one of the highest value projects you can finish this month.
This is not an enterprise IT project. A team of five can go from spreadsheet chaos to a properly organised password manager in about a week, spending roughly the cost of a team lunch each month. This guide gives you a day by day plan that actually works for busy, non technical teams, including what to do about contractors, what to do when someone leaves, and how to stop the whole thing quietly dying after a fortnight.
Why shared passwords in chat are quietly costing you
Most small businesses do not have a password problem because they are careless. They have one because sharing logins is genuinely necessary. Five people need the social media accounts. Three people need the booking system. The founder needs the banking app, but the bookkeeper needs it too. So the passwords end up wherever is convenient: WhatsApp, email threads, a shared Google Doc, a notebook in a drawer.
The trouble is that convenient sharing has three hidden costs. First, there is no way to take a password back. If you sent a login over chat and someone leaves the company, that message still exists on their phone. You cannot pull it back. Second, there is no record of who used what. If something odd happens in an account, a strange purchase or a settings change nobody admits to, you have no way to check. Third, passwords shared this way never get updated. The old social media password from three staff members ago is probably still the current one.
A password manager fixes all three at once. Instead of sending passwords to people, you put them in a shared vault and give people access to the vault. When someone leaves, you remove their access. The vault keeps an access log, and when a password changes, everyone with access gets the new one automatically. Nothing travels through chat again.
Start with a password audit before you buy anything
Before you spend a penny or invite a single team member, spend one focused afternoon finding out where your passwords actually live. You cannot organise what you cannot see, and most teams are surprised by how many accounts they have.
Start by listing every shared account your business uses: social media, email marketing, the website, hosting, the accounting software, the bank, suppliers, booking tools, domain registrar, and anything else people log into for work. For each one, note who knows the password, where it is stored right now, and whether anyone who has left the business could still know it. Be honest. A password written on a whiteboard in the office counts.
While you are at it, check for the two patterns that cause most small business breaches. The first is password reuse: the same password protecting the email, the bank and the social accounts. The second is logins nobody owns: accounts set up by a contractor in 2023 that everyone shares and nobody controls. Your audit should flag both. These become your priority list for the rollout week.
This audit also settles the budget question. Most business password managers charge per user, so knowing exactly who needs access stops you paying for seats nobody uses. Part time staff, regular contractors and anyone who only needs one shared login still need a seat, because sharing a single login to the password manager itself defeats the entire purpose.
How to Set Up a Password Manager for a Small Team in One Week
Here is the plan. One owner, one week, seven small steps. Each day takes between thirty minutes and two hours, and none of it needs technical skill beyond installing a browser extension.
Day 1: choose your owner and your tool
Every rollout needs one owner: a named person who makes the decisions and keeps the week on track. In a tiny team this is usually the founder or the office manager. The owner does the setup before anyone else is invited, so day one is just picking the tool and creating the admin account.
For most UK small teams, the shortlist is simple. 1Password is the easiest rollout: polished apps, shared vaults and a Teams starter pack that suits up to ten people. Bitwarden is the open source option and the cheapest, and it can be self hosted if you ever want that control. Dashlane is a clean all rounder with a useful password health view. Keeper is worth it if you need strict admin controls or audit reporting for clients. All of them offer free trials, so trial one properly for the week rather than agonising over the choice.
What matters more than the brand is the feature checklist: shared vaults or collections, an admin panel that shows who has access to what, a way to revoke access when someone leaves, and support for 2FA on the vault itself. Every tool above has these. Pick the one your least technical team member will tolerate, because adoption beats features every time.
Day 2: lock down the master account and switch on 2FA
The master password is the one password everyone must still remember, so make it a proper passphrase: four or five random words strung together, something like “correct battery horse staple” but with your own words and ideally longer. Write it down on paper once, keep the paper somewhere safe, and never store it digitally.
Then switch on two factor authentication for the password manager itself, before any real passwords go in. Use an authenticator app rather than text messages. This single step is what stops a stolen master password from becoming a catastrophe. Most tools will also give you emergency recovery codes at this point. Print those and store them with the paper copy of the master password, somewhere only the owner can reach. For more on keeping copies of critical business documents safe, see our guide to backing up business files automatically.
Day 3: build shared vaults by function
Now organise your vaults before any passwords move in. Create separate shared vaults by function, not one giant vault for the whole team. A typical small business needs a marketing vault for social media and ad accounts, a finance vault for banking and payment processors, an admin vault for hosting and domains, and maybe a client vault if you manage accounts for customers.
The rule is simple: people get access to the vaults they actually need, and nothing else. A designer does not need the banking vault. A bookkeeper does not need the social media vault. Keep the sensitive vaults small. If your tool supports hiding the password so people can autofill a login without seeing the actual characters, use that for the most sensitive accounts. It means the password never leaves the vault even while it is being used.
Day 4: import what your browsers already know
Most of your team already has dozens of passwords saved in Chrome or Edge. Do not ask anyone to type them all in by hand. Every major password manager can import a CSV export from a browser in a few minutes. Have each person export their saved work passwords and import them into their own private vault first, not the shared ones.
This is also the day to clean house. The import will surface the embarrassing stuff: the same password on twelve sites, passwords that are just the company name with a number on the end, logins to services you stopped paying for in 2024. Let the tool’s security report flag the weak and reused ones, then fix the shared accounts first and the personal ones second. Deleting dead accounts now saves confusion later.
Day 5: train the team in thirty minutes
Book a single thirty minute slot with everyone in the room or on the same call. Do not send a PDF and hope. Walk through three things only: how to install the browser extension, how to save and autofill a password, and where the shared vaults live. Then have everyone do it on their own machine while you watch, because the step everyone skips is installing the extension, and without it the manager never becomes a habit.
Set the expectation out loud: from today, every work password lives in the manager, and no work password goes in chat, email or spreadsheets. Frame it as making their lives easier, not as a security lecture, because it genuinely is easier. Autofill beats digging through WhatsApp history every single time. The next section has more on winning over reluctant staff.
Day 6: rotate the passwords that matter most
Moving a compromised password into a vault does not make it safe. Today, change the passwords on your most important shared accounts and let the manager generate the new ones: long, random, unique. Start with email, banking, payment processors, hosting and social media, the accounts your audit flagged as reused or known by former staff.
Do the high value ones properly. Log in, change the password, let the manager save the new one, and confirm the new login works before moving on. For anything where a former employee or contractor might still have access, this rotation is the moment your security actually improves. Everything before today was organisation. Today is protection.
Day 7: write down your offboarding rule
The final step is the one almost every team skips, and it is the reason the whole project pays for itself. Write a short offboarding rule and store it where you will actually find it, perhaps in the same place as your other business documents. If your filing is due an overhaul, our guide to creating a digital filing system for a small business will help.
The rule needs four lines. When someone leaves: remove them from every shared vault before their last day. Rotate any password they knew from memory, not just ones in the vault. Check whether they had the manager installed on a personal phone and revoke that device. Reassign any accounts they owned, like the domain registrar or the ad account, to a current team member. Make this part of your normal leaver process alongside collecting the laptop, and you will never again wonder who still has the keys.
What to do about contractors and one off logins
Contractors break every tidy system, because they need access quickly and leave sooner than you expect. The good news is that a password manager handles them better than any alternative. Create a dedicated vault for each contractor or project, put only the logins they need in it, and invite them as a guest user. When the project ends, remove them from the vault and rotate anything they saw. It takes two minutes and it is infinitely better than texting credentials and hoping.
Some credentials genuinely cannot live in a vault. API keys baked into config files, ancient systems with no browser autofill, or a supplier who phones up asking for a password right now. For these, use a self destructing link service that shows the credential once and then destroys the link, so it does not sit in anyone’s message history forever. Then rotate the credential afterwards if you can, and note what happened in the vault’s secure notes. Temporary access should be temporary, and a quick note means you remember to clean it up.
How to get non technical staff to actually use it
The technology is the easy part. The hard part is Dave in sales, who has used the same password since 2016 and sees no reason to change. Password manager rollouts fail on adoption, not on features, so treat this as a people project.
First, remove every excuse. Install the extension for them if you have to. Import their passwords for them. The biggest reason people do not use a password manager is that the first ten minutes feel like effort, and once they are past that, autofill sells itself.
Second, never lead with fear. Nobody adopts a tool because they were told about breach statistics. They adopt it because logging in got faster and they stopped getting locked out of accounts. Show the team the autofill. Show them the password generator. Let the security be a side effect they get for free.
Third, give it a fortnight and then check the admin panel. Every business password manager shows you who has not logged in, who still has weak passwords and who is not using 2FA. A friendly nudge to the two people who never finished setup beats a company wide reminder email. If someone is genuinely struggling, sit with them for ten minutes. It is always quicker than you expect.
The mistakes that make teams abandon their password manager
Most failed rollouts fail for the same handful of reasons, and all of them are avoidable.
The classic mistake is one shared login to the password manager itself. If three people all log in as “admin”, you have recreated the exact problem you were solving, with a fancier interface. Everyone gets their own account. No exceptions.
The second mistake is vault sprawl: dozens of vaults with confusing names, half of them empty, nobody sure which one is current. Keep the structure simple. Fewer vaults with clear names beat a perfect taxonomy nobody understands. You can always reorganise later.
The third mistake is skipping the rotation. Teams move all their old passwords into the vault, feel organised, and stop. But the old reused passwords are still the old reused passwords. Day 6 exists for a reason. Rotate the important ones or the whole exercise was just expensive tidying.
The fourth mistake is treating the rollout as finished. A password manager is a living system. New starter? They get an account and the vaults they need on day one. Someone changes role? Their vault access changes too. Someone leaves? The offboarding rule runs. Five minutes of admin a month keeps the whole thing trustworthy. Ignore it for a year and you are back where you started.
What it costs in the UK and how long it really takes
For a small UK team, budget around £3 to £7 per user per month depending on the tool, with most teams landing near the middle of that range. A five person team therefore costs roughly £180 to £420 a year. Annual billing usually trims 15 to 20 percent off the monthly price, and every serious option offers a free trial of at least two weeks, which comfortably covers the rollout week.
Against that, weigh what a single compromised account costs: a hijacked social media profile during a product launch, a fraudulent payment nobody notices for a month, or the quiet dread of knowing three ex contractors could still log into your booking system. The maths is not close.
Time wise, the owner spends roughly a day spread across the week, and each team member spends about an hour, most of it on the training day and the import. If you are a team of two or three, you can compress the whole plan into a long afternoon. The week long version exists so the work fits around real jobs, not because the work itself is large.
Your team, one week from now
Learning how to set up a password manager for a small team is not really about the software. It is about deciding, once, that passwords are a business system like any other, with an owner, a structure and a leaver process. Do the audit, pick your tool, build your vaults, train the team, rotate the critical passwords and write down the offboarding rule. A week from now, nobody will be texting logins, nobody who left will still have access, and logging in will be faster than it was before. That is a rare thing in business technology: genuinely more secure and genuinely easier, at the same time.
Frequently asked questions
Is a password manager safe for a whole team?
Yes, provided you choose a reputable tool and switch on 2FA for the vault itself. Business password managers encrypt your data so that even the provider cannot read it. The realistic risk was never the encryption; it was passwords sitting in chat history and spreadsheets, which is exactly what the manager eliminates.
How much does a business password manager cost?
Most charge per user per month. For a UK small team expect roughly £3 to £7 per user per month, so a five person team pays around £180 to £420 a year. Annual plans and free trials bring the first year cost down, and free open source options like Bitwarden exist if the budget is truly zero.
What happens to passwords when an employee leaves?
You remove them from every shared vault, which instantly cuts their access, then you rotate any password they knew from memory. This is why the offboarding rule matters: without it, ex employees keep access indefinitely. With it, a leaver is fully cut off in about five minutes.
Can we share passwords with freelancers and contractors?
Yes. Create a project vault with only the logins they need, invite them as a guest, and remove them when the work ends. For single credentials that cannot go in a vault, use a self destructing link and rotate the password afterwards. Never add a contractor to your main shared vaults.
Should we use passkeys instead of a password manager in 2026?
Use both. Passkeys are excellent where they are supported, and most password managers now store them too. But plenty of business tools still need old fashioned passwords, from legacy supplier portals to industry specific software. A password manager covers everything; passkeys cover the modern slice. They complement each other rather than competing.
