Buying a password manager is the easy part. Getting everyone to use it while they are answering calls, sending invoices and covering a colleague’s holiday takes a little more thought.
The tool needs to fit those ordinary jobs. Otherwise the old spreadsheet, reused password or message asking “what’s the login again?” will survive alongside it.
A small rollout gives you time to find the awkward bits. The plan below is a practical suggestion for a small business, not a certification requirement or a recommendation to buy a particular product.
Find out where people get stuck
Ask a few colleagues which accounts they use during a normal week and how they sign in. Ask for service names and problems, not their passwords.
Look for three things: accounts that already use company sign-in, accounts with separate passwords and accounts several people share. You may discover that a forgotten supplier portal is causing more trouble than the main office software.
The NCSC’s password policy guidance encourages organisations to reduce password overload and provide suitable ways to store credentials. Where a service supports separate accounts for each person, use them. A shared password should not become the default just because a vault makes sharing easier.
Choose a first group that represents real work. Include someone who uses a phone, someone who handles a shared business account and someone who is likely to ask questions. A trial made up entirely of confident technical users can miss the problems everyone else will face.
Choose features you can explain
The NCSC’s password manager buyers guide covers security and usability considerations, including protected storage, updates, autofill and recovery. Use it with your IT supplier to check a shortlist.
Ask each supplier to demonstrate the things your team will actually do. Can someone save a new login, find it next week and use it on an approved phone? Can the business manage shared credentials without putting every employee in the same vault? What happens when an administrator is away?
Check the exact subscription you would buy. A feature shown in a demonstration may belong to a different plan. Also check which devices and browsers are supported, how updates are delivered and what help is available when someone is locked out.
Avoid a buying decision based only on the longest feature list. A modest setup that colleagues understand is more useful than a complex one nobody has time to manage.
Protect the vault account first
Follow the provider’s instructions for setting up the account and securing its recovery options. Use a strong, unique master password where the product requires one, and enable multi-factor authentication. The NCSC’s password manager exercise highlights these basics and keeping the software updated.
The person helping with setup should not ask a colleague to read out their master password or send a recovery code in chat. Walk through the process while letting them enter private information themselves.
Agree what happens on shared computers and when someone steps away. Show people how to lock the vault. Give them a trusted route for installing the correct app or browser extension so they don’t have to search through lookalike results.
Sort out recovery before moving everything
Imagine the main administrator loses their phone on the same morning a colleague forgets their vault password. Who can help, and can they reach the instructions without signing into the locked vault?
Recovery arrangements vary. As one example, 1Password’s recovery planning guidance recommends having more than one person able to recover accounts and explains the limits of support from the provider. Check the equivalent instructions for your chosen service.
Choose recovery administrators deliberately. Protect their accounts and document how they verify a request. Store emergency information securely in a place that remains accessible during the incident it is meant to solve. Test the agreed procedure using a suitable test account before relying on it for the whole business.
Keep shared work logins in the right place
Create small groups or vaults based on who needs access. The people managing social media may need those credentials without needing finance logins too. Give each shared area an owner who can review membership.
1Password’s vault guidance illustrates how individual and group permissions can both affect access. Your product may call these areas collections or folders. Check the permissions, not just the label.
Explain where work credentials belong and keep personal accounts separate. Connect the rollout to your staff offboarding checklist. Removing vault access cannot make someone forget a password they previously saw, so assess which shared credentials need changing when access ends.
Move accounts in manageable batches
Start with a few ordinary accounts and confirm that colleagues can sign in again. Saving an existing weak or reused password does not improve that password. Use the manager to generate a unique replacement where appropriate, following the service’s requirements.
Take care with imports. Bitwarden’s export documentation distinguishes unencrypted formats from encrypted exports. A spreadsheet of passwords created during migration needs protection too. Follow your IT contact’s transfer and cleanup procedure, and don’t leave it in a shared folder.
After a week, ask the trial group what slowed them down. Fix those issues, then expand the rollout. Keep a short guide covering the tasks people repeat and the contact for help. The useful measure is whether staff can get into the right accounts safely without falling back on the old shortcuts.