The short answer: A shared password spreadsheet or a message in Teams will fail as soon as someone leaves the company—there is no way to know what they managed to copy, so everything has to be changed. A business password manager stores credentials in an encrypted vault and grants access to groups of people instead of sending passwords to their inboxes. In practice, small businesses without their own IT team have three sensible options: Bitwarden (open-source and can be hosted on your own server), 1Password (administrators can recover accounts when users forget their passwords), and Keeper (detailed role policies and vault transfers when someone leaves). Setting one up in a small business takes an afternoon, followed by a few weeks for employees to get used to it.
Why a shared password spreadsheet will eventually backfire
Most small businesses operate in much the same way: a passwords.xlsx file on a shared drive, perhaps a note in OneNote, or a pinned message in a team chat. It works for years—until one of four things happens.
Someone leaves. At that point, you cannot determine everything that person knew. They may have opened the spreadsheet a hundred times, copied it, photographed it with their phone, or sent it home. The only responsible response is to change every password in the company. With dozens of services, that means a full day of work and almost certainly an outage because someone forgets an account used by the invoicing system. If you are already in this situation, follow the procedure in your IT administrator has left—how to take control of company IT; this article explains how to avoid ending up there again.
Nobody knows who knows what. A spreadsheet keeps no records. You cannot find out who opened it and when, whether the accountant also copied the website administration credentials, or who gave the online store password to an external designer. Without that information, you cannot establish the scope of an incident—and scope is the first thing your insurer will ask about.
One password is used everywhere. A spreadsheet encourages people to remember passwords, which in turn encourages short, reused passwords. A single password exposed in a breach at an unrelated service can then unlock company email, banking, and accounting systems. The article ransomware in a business: the first 24 hours explains what happens next.
The file multiplies. It gets copied to the desktop, attached to an email, or left in the downloads folder. After a few years, several versions exist in several places, and some still contain valid passwords. Even if you protect the file with a password, everyone who needs to view it knows that password.
How a password manager works
The principle is straightforward, and it is worth understanding before you choose a product.
Your vault is encrypted on your device, not by the provider. The data is encrypted on your computer before it is sent anywhere. Bitwarden describes this in its security documentation as end-to-end AES-256 encryption, with the encryption key derived from the master password using PBKDF2 or Argon2id. Neither the master password nor the keys are sent to its servers. 1Password and Keeper use the same model, known in industry jargon as „zero knowledge." In practical terms, anyone who steals data from the provider’s servers gets an encrypted package, not your passwords.
You sign in with one master password plus a second factor. The master password is the only password you have to remember, so it should be long—more like a sentence than a word. It should be accompanied by a second factor: an app on your phone, a hardware key, or sign-in through your company account.
The browser extension only fills credentials on the correct domain. Bitwarden stores a web address with each entry, and its default matching mode is „base domain": a password saved for google.com will be offered on accounts.google.com, but not on google.net. On a fraudulent page that looks like your bank’s login screen but runs on a different domain, the extension remains silent—not because it has recognized the scam, but because the domain does not match. That silence is a signal: if a password is not offered where it normally would be, it is not a malfunction but a warning.
Sharing does not mean sending. A password is not sent to someone in a message. Instead, it is placed in a group of records that selected people can access. When the password changes, it changes for everyone at once.
Bitwarden vs. 1Password vs. Keeper
All three are established products with business plans, and all three charge a monthly fee per user. Pricing changes, so always check the vendor’s website. The comparison below focuses on features that are not affected by price changes.
| Feature | Bitwarden | 1Password | Keeper |
|---|---|---|---|
| Source code and hosting | Source code is publicly available on GitHub; it can be hosted on your own server, while paid features require a licence tied to an active subscription | Proprietary software hosted in the vendor’s cloud | Proprietary software hosted in the vendor’s cloud |
| How access is organised | Organisation → collections; individuals and groups can be assigned, while nesting is only for organisation and does not inherit permissions | Vaults + custom groups based on project, department, or location | Shared folders + teams + roles |
| Permission levels | Per collection (view, edit, and additional permissions depending on the role) | Per vault: View, Create, Edit, Archive, and Delete Items | Can Manage Users / Can Manage Records / both / neither, plus enforcement policies governing creation and sharing |
| Sign-in with a company account (SSO) | Login with SSO, supporting SAML 2.0 and OIDC on the Enterprise plan, plus SCIM provisioning | Unlock with SSO, available only on the Business plan (Entra ID, Okta, Google Workspace, JumpCloud, Duo, OneLogin, Ping, Auth0); members of the Owners group cannot unlock through SSO, preventing them from locking themselves out | Keeper SSO Connect with SAML 2.0—AD FS, Entra ID, Okta, Google Workspace, Ping, JumpCloud, and others |
| Auditing and reports | Organisation reports covering exposed, reused, and weak passwords, unencrypted websites, disabled two-factor authentication, and Member Access | Audit log with 365 days of history covering groups, items, sharing, and MFA changes, plus team and device reports and Watchtower | Advanced Reporting & Alerts logs access, edits, sharing, and deletion within shared folders |
| When an employee leaves | Removing or suspending the member terminates access to collections | Removal from groups and vaults | Removing a user from a team automatically revokes access to its folders; Account Transfer Policy transfers the entire vault to another user |
| Forgotten master password | An administrator can reset credentials, but only for members enrolled in account recovery in advance | Recovery can be initiated by an owner, administrator, or group with the Recover Accounts permission; the user receives a new Secret Key | A 24-word BIP39 recovery phrase created when the account is set up; Keeper cannot access it or assist with recovery |
How to choose between them
Bitwarden makes sense if you want to inspect the source code or keep the data on your own server. Self-hosting is free, but paid features require a licence tied to an active subscription—and someone still has to update and back up the server. If your company does not have anyone who can do that, use the vendor-hosted cloud service and treat the open-source code as a guarantee of transparency.
1Password is a good choice when you need to account for the fact that people forget passwords. Administrator-led account recovery does not require users to record anything in advance. However, at least two people should have recovery permissions. The documentation explicitly warns about this because otherwise the company could be locked out as soon as its sole administrator loses access.
Keeper makes sense when you have many roles and need precise control over who may create, share, and redistribute records. Its account transfer policy comes closest to what business owners mean when they say, „I need to know I can still access everything after someone leaves." However, the policy must be enabled in advance, and the original account is deleted after the transfer.
The business features that make it worthwhile
A business plan differs from a personal version in three crucial ways.
Shared collections for individual teams. Accounting can access banking and accounting software, sales can access the CRM and online store, and marketing can access social media and analytics. Nobody except administrators can see everything. Role-based access is not bureaucracy—it limits the damage if one account falls into the wrong hands.
Access can be revoked in a single action. When someone leaves, removing them from the organisation or team terminates their access without requiring every password to be changed. That is the key difference from a spreadsheet, where every password does need to be changed.
Reports on weak and reused passwords. Both Bitwarden and 1Password can scan the vault and show where the same password is used for multiple services, where passwords are too short, and which credentials have appeared in data breaches. Run this report once after deployment—the passwords imported from browsers will produce a surprisingly long list.
If your business falls under the zákon o kybernetické bezpečnosti and NIS2, you will need to demonstrate how access is recorded and revoked. A password manager does not ensure compliance on its own, but without one, this part is virtually impossible to document.
What the LastPass breach revealed
It is only fair to acknowledge that password managers are targets too. On 22 December 2022, LastPass published an incident update about an attack that began in its development environment in August 2022 and continued in its cloud storage in November. According to the company, the attacker copied a backup of customer data, including vault backups. These contained unencrypted website addresses, while usernames, passwords, secure notes, and form data were protected with AES-256 encryption. LastPass stated that it neither knew nor stored users’ master passwords.
The lessons apply regardless of the product you choose. Your master password must be long and used nowhere else—if a vault backup is stolen, its strength is the only thing standing between the attacker and its contents. And metadata is still information: a list of addresses reveals which services a company uses, which is enough to launch targeted phishing attacks.
Migration: how the rollout works
This process has worked well for us in businesses with up to fifty employees.
1. Take stock of what you have. List every service: email, banking, accounting, online store, CRM, domain, hosting, social media, VPN, cameras, and printers. There are usually more than anyone expects. For each one, note who uses it.
2. Export passwords from browsers. In Chrome, go to chrome://password-manager/settings and select the option to download the file. This produces a CSV file that can be imported into the vault. That file is readable plain text. Bitwarden’s documentation explicitly instructs users to delete it after import, including emptying the recycle bin or trash. Do not send it by email or chat.
3. Build the collection structure before inviting users. Name collections after business functions, not people. „Accounting,„ „Website and online store," and „Infrastructure„ will survive staffing changes; „Peter’s passwords" will not survive anything.
4. Roll it out team by team. Start where the most credentials are shared—usually website administration and accounting. Give one team one week, collect feedback, and then move on to the next. Launching across the entire company in a single day often leaves you with two password records instead of one.
5. Disable password storage in browsers. Otherwise, new passwords will continue accumulating there while the vault becomes outdated. Once the import is complete, delete the passwords stored in the browsers.
6. Address master-password recovery before anyone forgets theirs. This is the step most often skipped and the one that hurts the most when it is missing. With Bitwarden, members must be enrolled in account recovery in advance—without enrolment, an administrator cannot reset their credentials. In 1Password, at least two people should have recovery permissions. When a Keeper account is created, the user receives a 24-word recovery phrase; if that phrase is lost and the password is forgotten, even the vendor’s support team cannot help. Print the recovery information and store it with the company’s documents.
7. Document the offboarding process. Specify who must be removed, from which collections, who checks that it has been done, and by what deadline. Without a written process, former employees can remain members of the organisation for months.
8. Run the reports after one month. Review weak, reused, and exposed passwords, and change everything the reports identify. This will also show whether employees are actually using the tool.
Two final mistakes to avoid. Sharing a single account between several people—typically something like office@—undermines accountability because the logs cannot show who performed an action. Whenever possible, give each person an individual account. And a password manager is not a backup: it protects access credentials, not the underlying data. The article how much IT support costs for a small business explains what is included at each level of managed IT service.
Need help setting it up?
ITHOPE (Brno) helps businesses choose and deploy password managers based on their headcount and operational needs. We design the collection structure, import passwords from browsers and old spreadsheets, configure master-password recovery so that the company cannot lock itself out, and document an offboarding process that people can actually follow. This complements our standard IT management and backup services; you can find our other services in the IT for businesses section. Get in touch—we will review the systems your company uses and tell you whether a basic plan is sufficient or whether SSO is worthwhile.
Sources
- Bitwarden Security Whitepaper
- About Collections (Bitwarden)
- Account recovery administration (Bitwarden)
- URI match detection (Bitwarden)
- Import from Chrome (Bitwarden)
- Recover accounts (1Password)
- Unlock with SSO (1Password)
- Account Transfer Policy (Keeper)
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).