Short answer
Any reputable business password manager beats the spreadsheet. Pick one with shared collections, per-person access, MFA and admin recovery. Bitwarden, 1Password Business and Keeper are the usual shortlist, and a self-hosted Bitwarden-compatible vault works too if someone's looking after it. The brand matters less than you'd think; the roll-out matters more, because a vault half the team ignores is a spreadsheet with extra steps.
Why the spreadsheet and the browser aren't enough
The password spreadsheet fails in three ways, and every business that has one has met at least two of them.
- Reuse. When passwords are a pain to look up, people reuse them. One breached supplier portal then opens your email, your bank and your job software, because it's the same password everywhere.
- Leavers. A spreadsheet can't be un-shared. Someone who left in March still knows every password that was in it, and most businesses never change them.
- No audit. Nobody knows who looked at what, who changed what, or whether the "current" version is current.
Letting the browser remember passwords is a bit better and has its own problems. The passwords sync to whichever personal Google or Apple account the browser is signed into. There's no way to share one with a colleague except by sending it. Nobody can recover or revoke anything when a laptop or a staff member goes, and the business can't see any of it. The browser is a convenience for the person; it isn't a system for the business.
A password manager fixes all of that, and adds one benefit people don't expect: it only fills a password on the real website. A phishing page that looks identical gets nothing, because the address is wrong.
What a business needs that a personal plan lacks
- Collections per team, not one shared pile: office, field, marketing, finance, admin.
- Least-privilege sharing. Each person sees only the collections they work in, and some of those read-only.
- Admin recovery. When someone forgets their master password, or leaves without handing over, an administrator can recover or reassign what's theirs.
- Reports on weak, reused and breached passwords, and accounts without MFA, across the whole business.
- Enforcement. MFA required for every vault login, and sign-in through Microsoft 365 or Google if you have it.
- An event log, so you know who touched what and when.
- Offboarding in one step. Remove the person and their access ends.
- A safe way to send a one-off password to a client or contractor that expires on its own.
Features to look for
| Feature | Why it matters | What to ask the vendor |
|---|---|---|
| Shared collections with per-person access | Nobody sees everything, and a leaver loses only what they had | Can I give one person read-only access to one collection? |
| MFA enforced for every user | The vault holds the keys to everything; a password alone isn't enough | Can I make MFA mandatory rather than optional? |
| Admin account recovery | Forgotten master passwords and sudden departures both happen | What happens when someone leaves without handing over? |
| Health and breach reports | Finds the reused and leaked ones before an attacker does | Does it check against known breach lists? |
| Single sign-on with Microsoft 365 or Google | One identity to manage; disable the person once and they're out of everything | Which identity providers does it support, and on which plan? |
| Browser extension and phone apps with autofill | If it's clunky, staff go back to the spreadsheet | Does it fill inside the field app on a phone? |
| Passkey support | Password-free logins are replacing passwords on the big sites | Can it store and use passkeys on every device? |
| Export | So you can leave, or move to a new tool, without retyping | Can I export everything in a readable format? |
| Emergency access | A trusted person can get in if the owner can't | Is there a break-glass process, and who approves it? |
| Audit log | Shows who viewed or changed an entry | How long is the log kept, and can I export it? |
The big three all tick most of these on their business plans. The differences are in the admin console, the price per user and how well the phone app fills. Trial two with the actual people who'll use them.
The roll-out in five steps
- Inventory. List every account the business uses: software, suppliers, utilities, social media, government portals, the bank. Note who owns each, who needs it, whether it has MFA, and which ones are a personal login being used for business. This takes an afternoon and is the most valuable part of the whole job.
- Structure the collections. By team or function, never by person. Agree a naming rule for entries ("Supplier – trade account – branch") so people can find things, and decide who the administrators are: two people, not one.
- Import. Pull in the browser's saved passwords and the spreadsheet. Then treat everything that was in the spreadsheet as exposed and change it, starting with email, the bank, job software and anything with your card on file. Let the manager generate the new ones.
- The staff session. Thirty minutes, everyone in the room or on the call. Install the extension and the phone app, set a master passphrase (see below), turn on MFA, fill a login together, and agree that the browser's own saving is off from today.
- Enforce it and kill the spreadsheet. Make MFA mandatory in the vault's policy, turn off browser password saving on managed laptops, delete the spreadsheet (and the copy in Downloads, and the one in the shared drive), and put a monthly reminder in the diary to look at the reports.
Offboarding with a password manager
Done properly, the day someone leaves looks like this. Their vault access is removed in the morning, which cuts them off from every shared password at once. The administrator reads the list of what they could see and rotates the shared accounts in those collections, starting with anything that can spend money or send email. Their own named logins (Microsoft 365, job software, the phone system) are disabled by whoever runs the Microsoft side. The collection structure is what makes this a one-hour job instead of a guessing game, and our Microsoft 365 offboarding checklist covers the other half.
The accounts that can't be shared properly
Some logins are tied to a person by design. For those, the right answer is separate access per person rather than one shared entry:
- Bank portals. Give each person who needs it their own user with their own limits and their own token. The owner's login never goes in a shared collection.
- Government portals. myID (the Digital ID that replaced myGovID) belongs to the individual and must never be shared. The business authorises each person in Relationship Authorisation Manager for ATO online services and the other portals that use it.
- Microsoft 365 admin. Day-to-day administration through named accounts. One break-glass global admin lives in the vault, with its MFA kept separately by the owner.
- Social media. Use the platform's own roles (Meta Business Suite, LinkedIn page admins) so each person signs in as themselves.
- Anything with MFA that genuinely must be shared. Store the authenticator secret in the vault entry so the team can log in, and keep the recovery codes with the administrator.
Passphrases, per the ACSC
The one password each person still has to remember is the master passphrase for the vault. The Australian Cyber Security Centre's advice is a passphrase: four or more random words, at least 14 characters, unique to that account, and not a sentence anyone could guess from your social media. "kettle-granite-sparrow-ledger" is the idea; your dog's name and the year you got married is not. Everything else the manager generates, long and random, and nobody needs to remember any of it.
Then MFA on the vault itself, with the recovery codes printed and locked away, not stored in the vault they unlock.
Where we fit
For clients on a security plan we run a managed vault: one collection per team, each person sees only what they work on, access ends the day they leave, and an inventory of entry names (never the passwords themselves) is kept in the client's own records so you always know what's in there. The vault is yours; if we part ways, you keep it and everything in it. It's part of our security and compliance work, from $150 a month on any support plan, and the detail is in the password section of our cyber security page.
Sources
- Australian Cyber Security Centre: Small business cyber security handbook (passphrases and multi-factor authentication), Essential Eight
- Vendor documentation: Bitwarden collections, 1Password support
Checked 31 October 2026. We don't take referral fees from any password manager. If something here looks out of date, tell us.