How to Roll Out a Password Manager Across a Small Company in One Afternoon

Every security review I do for a small company starts the same way. I ask five people how they log in to the tools they use every day, and at least three of them describe some version of the same password with a number on the end. Nobody is embarrassed about it — it is simply what humans do when they are asked to remember fifty secrets.

Attackers know this better than anyone. When a password leaks from one website, it gets tried on every other website within hours. This is called credential stuffing, and it works because the same password is waiting on the other side. NIST's guidance on digital identity (SP 800-63B) is blunt about it: the practical answer is not stronger memorised passwords, it is unique passwords, generated and stored by software.

That software is a password manager. Rolling one out is the highest-value security change most small teams can make, and it does not need a project plan. It needs an afternoon. Here is how I run it.

Before the afternoon: three decisions

1. Pick the tool. For a small business the honest shortlist is short: Bitwarden (open source, cheap, excellent), 1Password (polished, great onboarding), or the manager built into your existing platform if you are all-in on Google Workspace or Microsoft 365. Any of these is dramatically better than a spreadsheet or a browser's built-in store shared across personal devices. Do not spend a week comparing them; the difference between the best and the third-best is far smaller than the difference between any of them and nothing.

2. Decide who owns it. One person administers the organisation: invites, groups, offboarding. This is usually whoever already manages your email accounts.

3. Agree the rule. Write one sentence and put it where people will see it: "Every work login lives in the password manager, every password is generated, and every account that offers two-factor authentication has it turned on." That sentence is your policy. You do not need a longer one yet.

The afternoon, hour by hour

Hour one: the admin sets up the vault

• Create the organisation account using a long passphrase — four or five random words, written down and stored somewhere physical and safe. This is the one password the administrator still has to remember.
• Turn on two-factor authentication for the admin account immediately, ideally with a hardware key or an authenticator app, not SMS.
• Create three collections (Bitwarden) or vaults (1Password): Everyone, Finance, Engineering. Most small companies never need more than five. Do not model your org chart in vaults; model who genuinely needs which secrets.
• Add the shared logins that everybody already knows — the social media accounts, the domain registrar, the shared design tool. Change each of those passwords to a generated one as you add it. That single step removes the most dangerous secrets from chat history and sticky notes.

Hour two: the team installs it

Get everyone in one room or one call. Each person:

1. Accepts the invite and creates their own long passphrase. Explain that this is the only password they will ever type again, so it is worth making it good and worth writing it on paper at home.
2. Installs the browser extension and the phone app. The extension is what makes the manager stick — if it does not autofill, people will stop using it within a week.
3. Turns on two-factor authentication for the manager itself.

Then do the exercise that actually changes behaviour: everyone opens their five most-used tools, logs in, and lets the manager save each credential. Nothing more. You are not asking them to change passwords yet, you are asking them to stop remembering.

Hour three: rotate the important ones

Now go back through the saved list, starting with the accounts that matter most: email, banking and payment tools, cloud consoles, the code repository, anything with customer data. For each one, use the manager's generator to set a new unique password and, if the service offers it, enable two-factor authentication. Most teams get through their critical accounts in this hour; the long tail can happen over the following weeks and the manager's built-in "reused password" report will nag them until it is done.

Hour four: the boring bit that makes it real

• Emergency access. Set up emergency or recovery contacts so that if someone is unavailable, the business is not locked out. In 1Password this is the Emergency Kit; in Bitwarden it is Emergency Access.
• Offboarding step. Add one line to your leaver checklist: remove from the password manager, rotate any shared credentials they had access to. Shared logins are exactly the ones people carry with them when they leave.
• Personal accounts. Encourage — do not force — people to use the free personal vault most managers bundle with a business plan. Attackers do not respect the line between someone's personal Gmail and their work Google account, especially when the recovery address for one is the other.

The objections you will hear

"What if the password manager gets hacked?" A good manager encrypts your vault on your device with a key derived from your passphrase; the company running the service cannot read it. Breaches of password-manager companies have happened, and what attackers got was encrypted blobs. That is a far better position than the alternative, where one leaked password unlocks a dozen accounts. Choose a long passphrase and the maths is on your side.

"I'll forget the master password." That is what the paper copy at home and the emergency access are for. In practice, a passphrase you type several times a day becomes muscle memory within a week.

"It's slower." For the first three days, yes. After that it is faster than typing, because it fills the username, the password and the two-factor code.

"Can't we just use the browser's saved passwords?" Browser stores are better than nothing, but they are tied to a personal profile, hard to share safely, awkward to revoke when someone leaves, and often synced to devices you do not control. A proper manager gives you shared collections, an audit of who has what, and one switch to cut access.

What good looks like a month later

• No shared password exists anywhere outside the manager.
• Every generated password is unique; the manager's health report shows zero reused entries.
• Two-factor authentication is on for email, finance, cloud and code.
• Offboarding someone takes minutes, not a day of "what did they have access to?".

That is a small company that has quietly removed the single most common cause of its own breach. Everything else in security — backups, monitoring, incident plans — is easier once this foundation is in place. If you have not done it yet, block the afternoon this week.