Does your business need a password manager?

Yes. If your firm has more than a handful of logins, and it has dozens, a password manager is one of the cheapest improvements you can make.

Here's what it does, what to look for, and how to get your staff to use it.

How firms manage passwords now

Usually one of these:

• The same password everywhere, with a number changed at the end
• A spreadsheet called "passwords," on the shared drive
• Sticky notes, or a notebook in the top drawer
• Saved in the browser, on whichever computer the person happened to use

Each fails the same way. One breach, one stolen laptop or one departing employee exposes everything at once. We explain how a reused password travels in passwords on the dark web.

What a password manager does

It remembers every password, so each one can be long, random and different. Staff remember one strong password for the manager itself.

It fills them in, and only on the real website. A fake sign-in page gets nothing, which quietly defeats a lot of phishing.

It shares without revealing. The bookkeeper can use the bank login without ever seeing the password. When they leave, you remove their access in one step.

It shows you the weak spots: reused passwords, old ones, and any that have appeared in a known breach.

What to look for

• A business version, with an administrator who can add and remove people
• Shared folders, so access follows roles: partners, accounts, front desk
• Multi-factor authentication on the manager itself
• A recovery process for when someone forgets their one password
• An activity record of who accessed what

Don't use personal accounts for firm passwords. When the person leaves, the passwords leave with them, which is exactly the situation in what to do when your IT person leaves with the passwords.

Rolling it out

1. Start with the shared logins: the bank, the court and tax filing systems, the practice software, the domain registrar. These are the ones that hurt most when lost.
2. Set up folders by role.
3. Give everyone twenty minutes to install it and move their own passwords in.
4. Turn off saving passwords in the browser on firm computers.
5. Change the reused passwords, worst first. The manager will list them.
6. Add it to your joiner and leaver checklists.

Expect a week of grumbling and then silence. People stop noticing it once it works.

What it doesn't do

It doesn't replace multi-factor authentication. A password manager protects the password. MFA protects you when a password is stolen anyway. You need both; see why MFA comes first.

It doesn't stop someone approving a sign-in they shouldn't.

It's a single point to protect. That's why the manager itself needs a strong password and a second step.

The cost, against what it prevents

A business password manager costs a few dollars per person per month. Check the provider's current price.

Against that:

• The former employee who still knows the bank login, because it was never changed
• The reused password that opens a partner's mailbox, which the FBI's 2025 report ties to an average reported loss of about $123,000 when it turns into payment fraud (FBI Internet Crime Report)
• The insurance application, which asks how credentials are managed

It's an unusual security tool in that it also saves time. Nobody resets a forgotten password, and nobody hunts for the spreadsheet.

Where to start

Pick the ten logins that would hurt most if they leaked, and ask who knows each one today. The answer is usually the reason to start.

Our Business plan includes dark web monitoring, which alerts you when a firm password appears in stolen data. For a second opinion on where you stand, book a free Security Check.