Run a Password Manager for Your Team

Run a Password Manager for Your Team

Give every login its own strong passphrase, stop sharing passwords over email or sticky notes, and cut off access the day someone leaves.

When to use

When the team reuses the same few passwords, shares logins insecurely, keeps passwords in a spreadsheet or on notes stuck to the monitor, or when "someone's left and still knows our passwords". Also for "we need a password manager" or "stop reusing passwords".

Steps

1. Choose a reputable password manager. Compare a few well-reviewed options - this skill doesn't endorse any specific product. 2. Protect the manager itself with a long, unique master passphrase (four or more random words) and turn on MFA on the manager. 3. Give each staff member their own login - never one shared master account - so access can be switched off individually. 4. Use shared vaults or folders for genuine team logins (like the company social account) instead of emailing or messaging passwords around. 5. Work through your accounts and replace reused or weak passwords with unique passphrases the manager generates and stores. 6. Turn on the built-in security or breach check to find weak, reused or exposed passwords, and fix those first. 7. When someone leaves, remove their account and rotate any shared passwords they knew. 8. Don't also let the browser save passwords or keep them on paper at the desk - one secure home only.

When to call a professional

For a whole-team rollout, or to connect the password manager to Microsoft 365 or Google single sign-on, ask your IT provider or MSP.

ACSC reference: Aligns with ACSC guidance on using passphrases and password managers, supporting Essential Eight multi-factor authentication (cyber.gov.au/smallbusiness).