Choosing a password manager for a small business, and the offboarding rule that matters most
Any of the three business password managers most small firms consider (1Password, Bitwarden, Proton Pass) is a large step up from a shared spreadsheet or a browser's saved passwords. Pick on the admin features you need, then set up shared vaults and an offboarding routine on day one.
By the editors of ProtectYour.com Last reviewed 4 min read
Affiliate disclosure: this guide links to Proton for Business. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money
Key takeaways
- A business password manager gives each person their own vault plus shared vaults the owner controls, so access can be granted and taken back.
- 1Password, Bitwarden and Proton Pass all offer business plans with shared vaults, admin consoles and apps on every platform.
- SSO and automatic user provisioning are usually in the higher tiers. A team under ten rarely needs them.
- The point is offboarding: when someone leaves, remove their access in one place and rotate the shared passwords they knew.
- Browser-saved passwords are fine for personal use but weak for a business: no shared vaults, no admin, no clean offboarding.
Why a business plan, not everyone's personal one
Most small businesses already share passwords: the bank, the domain registrar, social media accounts, the shipping account, the Wi-Fi. They share them in a spreadsheet, a sticky note, a group chat or one person's head. When that person leaves, or their laptop is stolen, nobody knows which passwords they had.
A business password manager fixes three things at once:
- Shared vaults the company owns. Put the marketing logins in one vault and the finance logins in another, and choose who sees each.
- Admin control. An owner or admin can invite and remove people, require two-factor authentication and set password rules.
- Clean offboarding. Removing someone revokes their access to company vaults, and the tool shows which shared items they could see so you know what to change.
Our consumer password manager comparison covers the same products for households. This guide is about the business plans.
The three most small firms consider
Business password managers, from each company's published plans
| Product | Suits | Worth knowing |
|---|---|---|
| Proton Pass for Business | Teams that want privacy-focused tools from one company, alongside Proton Mail, Drive and VPN | End-to-end encrypted, Swiss company; SSO, SCIM and activity logs are in the higher business tier |
| Bitwarden Teams or Enterprise | Cost-conscious teams that want open-source, audited code | Can be self-hosted; Enterprise adds policies, SSO and admin account recovery |
| 1Password Teams or Business | Teams that want the most polished apps and onboarding | A flat-price Teams Starter Pack for small teams; SSO and directory integrations are in Business |
Check each company's current pricing page before deciding; plans and seat limits change. All three are reasonable choices. We earn a commission from Proton for Business sign-ups and nothing from Bitwarden or 1Password. That is why we name them plainly: for many teams, Bitwarden is the budget pick and 1Password is the one IT people already know.
Setting it up in an afternoon
- Make two admins. The owner and one trusted person, each with their own account and two-factor authentication. One admin is a single point of failure.
- Create shared vaults by job, not by person: Finance, Marketing, Operations, IT. Give each person only the vaults they need.
- Move the shared passwords in from wherever they live now, then delete the spreadsheet and the chat messages.
- Change the most sensitive ones as you go (bank, payroll, domain registrar, email admin), using long generated passwords and turning on two-factor where it is offered. Our guide to two-factor authentication explains which kind to pick.
- Write down the emergency route. Who can get in if the owner is unreachable? Use the product's recovery or emergency access feature and keep the recovery kit somewhere physical and safe.
Keep personal and company separate
The offboarding routine
Do these the same day someone leaves, even when they leave on good terms:
- Remove them from the password manager. Company vaults disappear from their devices.
- Use the manager's list of what they could see to change the shared passwords for the most sensitive accounts: bank, payroll, email admin, domain and social media.
- Disable their email and work accounts, and transfer ownership of files they created.
- Remove their phone or authenticator from any shared accounts that used it for two-factor codes.
Our small business security checklist covers the rest of offboarding, including admin accounts and devices.
Passkeys and the next few years
All three products can store passkeys, the phishing-resistant replacement for passwords that more services now offer. A business password manager is a good place to keep shared passkeys for team accounts because the company, not one person's phone, holds them. CISA recommends phishing-resistant multi-factor authentication for business accounts (CISA). See our passkeys guide for how they work.
Common questions
What is the best password manager for a small business?
1Password, Bitwarden and Proton Pass all offer business plans with shared vaults, admin consoles and apps on every platform. Bitwarden is often the budget pick, 1Password the most polished, and Proton Pass suits teams that also want Proton's encrypted email and storage.
Is it safe to share passwords with employees?
It is far safer through a business password manager than by spreadsheet or chat. Shared vaults let you choose who sees each login and remove access in one step when someone leaves.
What should I do when an employee leaves?
Remove them from the password manager the same day, change the shared passwords for the most sensitive accounts they could see, disable their work accounts and remove their device from any shared two-factor setup.
Can we just use Chrome or iCloud Keychain?
They are fine for personal use, but they lack company-owned shared vaults, admin controls and clean offboarding: the main reasons a business needs a password manager.
Your next step
If you want a paid toolAffiliate link
Proton for Business
Best for: Small teams that want encrypted email, a shared password manager and a business VPN from one privacy-focused company.
Not for: Teams already standardised on Microsoft 365 or Google Workspace that only need one missing piece, and anyone needing deep Office integration.
Visit Proton for BusinessRelated guides
- Small business cybersecurity checklist: the 10 controls that matter mostTen controls, in the order we would do them, for a business without an IT department. Most are free and take an afternoon.
- The best password manager for you: 1Password, Bitwarden, Proton Pass and the built-ins comparedAny decent password manager beats reusing passwords. The right one depends on which devices you use, whether you want to pay, and who you share logins with.
- Passkeys explained: what they are, where they live, and whether to switchA passkey is a login that replaces the password with a cryptographic key stored on your devices and unlocked with your face, fingerprint or PIN. It cannot be phished or leaked in a breach, so switch wherever a site offers one.
- How to send sensitive documents securely: tax forms, IDs, contracts and client filesRegular email is not a secure way to send Social Security numbers, tax forms or ID scans, as the FTC puts it. Use a link with access controls or encryption instead, collect documents through a portal rather than inboxes, and delete what you no longer need.