Rolling Out a Password Manager to a Small Crew

Why this matters

Most small shops keep their passwords in one of three places: a spreadsheet on the office computer, a notebook in the desk, or the owner's head. All three fail the same way. The spreadsheet gets emailed to the bookkeeper and now lives in two mailboxes; the notebook walks out with whoever had it last; the owner gets sick and nobody can get into payroll. A password manager is an encrypted vault that stores every login, fills it in for the person using it, and lets you share specific logins with specific people without telling them the password. Rolling one out to a crew of five to twenty people takes about two weeks of light effort. This card is the rollout, laid out in the order it actually happens, with an eleven-person landscaping shop carried through it.

What to look for when choosing one

Do not pick on price or on what the owner uses personally. Pick on the features a business needs that a personal plan usually lacks. As of 2026, most reputable products offer a business tier with these; check the vendor's current plan page, because features move between tiers.

Avoid using the browser's built-in password saving as the shop's system. It ties logins to whoever is signed into that browser, it is hard to share by role, and it leaves no clean way to remove a person's access when they leave.

Day 1: the owner sets it up alone

Step 1. Create the business account and the owner's vault, with a passphrase. The master password is the one password that unlocks the vault, and in most products the vendor cannot recover it for you. Make it a passphrase of four or five unrelated words, write it on paper, and do not use it anywhere else. Skip the paper and a forgotten master password can mean every login gone. Skip "anywhere else" and a breach of some unrelated site hands over the vault.

Step 2. Turn on multifactor for the vault, and store its recovery codes offline. Use an authenticator app rather than text codes. Print the recovery codes and put them with the master-password paper. Skip this and the vault is one phished password away from an attacker holding every account the shop owns. See related: Turning On Multifactor Authentication Without Locking Yourself Out.

Step 3. Name a deputy and set emergency access now, not later. Choose the second person who could run the shop's accounts if the owner were hospitalized: usually the office manager or a spouse who handles the books. Set the product's emergency-access feature so that person can request access and is granted it after a waiting period, typically a few days, which the owner can cancel if the request is not genuine. Then seal a copy of the master password and recovery codes in an envelope in a locked drawer or safe. Skip this and the most likely real emergency in a small shop, the owner simply being unavailable, stops payroll.

At the landscaping shop, the owner did all three in about an hour on a Sunday. His deputy is the office manager, with a three-day emergency-access wait.

Days 2 and 3: vaults by role

Step 4. Draw the vault map before importing anything. Split logins by who needs them, not by what kind of account they are. The landscaping shop used four:

• Owner only: bank, payroll, domain registrar, email admin, card processor payout settings, tax agency.
• Office: field-service software admin, accounting, supplier portals, the phone system, social and listing accounts.
• Field: the supply-house and nursery portals techs order from, equipment warranty portals, the shop's account on the irrigation controller platform.
• Shared crew: the yard gate code, the shop Wi-Fi, the fuel card PIN.

Skip the map and the import dumps everything into one vault that everyone can see, and fixing it afterward means moving entries one at a time while people are already using them.

Step 5. Give each person their own login to each system wherever the vendor allows it. A shared login (one username used by four people) cannot be removed from one person when they leave and shows nothing useful in any log. The field-service software almost certainly supports individual users; set them up. Keep shared logins only where the vendor genuinely offers no alternative, and put those in a shared vault. See related: The Shared Login Problem.

Days 4 and 5: migrating from the spreadsheet

Step 6. Import, then sort into the vault map. Most products import a spreadsheet saved as a CSV file. The landscaping shop's sheet had 64 rows. After import the office manager moved each entry into its vault, and deleted rows that were dead (a supplier gone out of business, a trial nobody used): 19 of 64. That left 45 live logins. Skip the sort and the dead rows become noise that hides the logins that matter.

Step 7. Destroy the spreadsheet everywhere it lived, then change what was in it. Delete the file, empty the computer's trash, and search every mailbox for the file name or for "passwords" as an attachment, because spreadsheets get emailed. The landscaping shop found it in two other mailboxes and a cloud folder synced to the bookkeeper's laptop. Then change every Owner-only login, starting with email and bank, since the old sheet has been copied to places you do not control. Skip this and you have a secure vault and an unsecured copy of its contents, which is no improvement at all.

Week two: bringing the crew on

Step 8. Onboard the office first, then the techs in one session. The office uses it daily and will find the rough edges. After three days, run one 30-minute session for the techs at the morning meeting: each installs the app, sets their passphrase, turns on multifactor, and logs into one Field login with it while you watch. Doing it individually over a month means half the crew never does it. Skip the "logs in once while you watch" and you will find in a month that four people installed the app and never used it.

Step 9. Set the rule in one sentence. "Every work login lives in the manager; no work passwords in notes, texts, or the browser." Then turn off password saving in the browsers on shop computers, so the old habit has nowhere to go. Skip the rule and the vault and the old habits run side by side indefinitely.

Week-two cleanup

Step 10. Run the manager's own health report and work it. Most products flag reused, weak and exposed passwords. At the landscaping shop the report showed 14 of the 45 live logins sharing one of three passwords, all variations of the shop name and a year: 9 in the Office vault and 5 in Field, none in Owner-only because step 7 had already changed those. The office manager replaced them over two afternoons with generated passwords of at least 16 random characters, Office first, since those logins reach customer data and suppliers' payment methods. She also found the fuel card PIN in a tech's phone notes and the gate code on a sticky note in a truck, both changed. Skip the cleanup and the vault holds the same weak passwords the spreadsheet did, now merely better organized.

What goes wrong in the first month

Three problems the plan above does not prevent, and the fix for each.

A tech is locked out at 7 a.m. on a job. He forgot his passphrase or got a new phone. Admin account recovery fixes it, but only if someone with admin rights is reachable; make sure the office manager, not just the owner, holds admin, and that the Field vault's most-used logins (the supply portal) can also be read out by the office in a pinch.

Autofill refuses to fill on a page. People take this as the manager being broken and type the password by hand. Often it is the manager working: it matches the saved web address, and a look-alike phishing page does not match. Teach the crew that a login that will not autofill is a reason to stop and check the address, not to type harder.

Someone leaves and saw the passwords. Removing a person from the vault stops future access but does not make them forget what they read. Where the product allows it, set the Field and Shared crew vaults so members can fill but not view passwords, and on any departure rotate every entry in the vaults that person could open. See related: The Employee Offboarding Digital Access SOP.

How you know it took

Three checks at the end of week two. Every person who needs a work login has logged into the manager at least once (the admin console shows last activity). The old spreadsheet returns no hits in a mailbox search. The health report shows no reused passwords in the Owner-only vault. Then one more test a month later: ask the deputy to request emergency access, let the waiting period run, confirm she gets in, and then revoke it. A plan you have never exercised is the one that fails on the bad day.

What would change the approach: a shop of two or three people can skip role vaults and use one shared vault plus the owner's private one. A shop where techs share company phones should give each tech their own app login on the shared phone rather than one login for the device, or the activity log tells you nothing. And a shop with a former employee who knew the spreadsheet should run step 7's password changes before anything else.

References

• See related: The Shared Login Problem
• See related: Turning On Multifactor Authentication Without Locking Yourself Out
• See related: The Account Inventory Every Shop Should Keep
• See related: The Employee Offboarding Digital Access SOP
• NIST Special Publication 800-63B on memorized secrets, which favors long passphrases over forced complexity and routine rotation