The Password Was Never the Problem: Rolling Out a Password Manager Without a Rebellion

Every small business has one. Sometimes it's a whiteboard in the comms cupboard. Sometimes it's a dog-eared notebook in the top drawer, or a spreadsheet called logins-FINAL-v3.xlsx sitting on a shared drive. And sometimes it's Debbie, who has been here eleven years and is, functionally speaking, the firm's identity provider.

None of this exists because people are reckless. It exists because it works. The whiteboard never forgets a password, never asks you to reset it on a Monday morning, and never sends a sign-in nudge to your phone while you're driving. That's the thing to hold onto when you start planning a password manager rollout: you're not replacing a bad habit, you're replacing a system that has been quietly reliable for years. Treat it that way and people will come with you.

The bit nobody says out loud

Most password manager projects fail in the same place. Not at the technology stage — the apps are, broadly, fine. They fail at the point where a business announces "we're moving to a password manager" in a Monday team meeting and expects the whole thing to be done by Friday.

The tool is the easy part. The change is the hard part, and it's a change in who holds what. When four people share one login to the accounting system, nobody is accountable for it and nobody has to think about it. Once each person has their own credentials and the shared one becomes a shared entry inside a vault, suddenly there's an audit trail, and audit trails make people nervous.

So don't sell it as security. Sell it as the end of "has anyone got the login for the council portal?"

Week one: find out what you're actually protecting

Before you buy anything, spend a week building an honest list. Not a security assessment — a list. Sit with whoever holds the institutional memory and go through it together, because if you hand out a form people will fill in the first six rows and invent the rest.

What you're looking for:

• Logins tied to a person rather than the business. The domain registrar in a former employee's name. The Microsoft 365 global admin under the founder's personal email. The insurance portal that only accepts the old office manager's address.
• Genuinely shared accounts. The trade supplier portal, the alarm system, the franking machine, the payroll bureau. Some of these can't be un-shared, and that's fine — they just need to live in the vault instead of on the wall.
• Anything with payment access. Bank, card processor, payroll, the account you use for HMRC. These get sorted first.
• The one-offs. The ancient FTP login nobody has touched since 2019. The webinar platform from a conference three years ago. Don't migrate these — close them.

Write it all into a boring spreadsheet and — this matters — delete the spreadsheet the moment migration is done. A password inventory is a genuinely dangerous document. Keep it on one machine, not in the shared drive, and don't email it to anybody.

Week two: pick a vault for the boring reasons

There are a dozen credible password managers and the honest truth is that most of them are good enough. Choose on the things a small firm actually needs, not on the marketing page.

Emergency access is the big one. If the person who runs the vault is hit by a bus, on a fortnight in Portugal, or simply leaves, someone else has to be able to get in. Look for a product with a proper emergency-access or account-recovery feature — one where a nominated colleague can request access and it unlocks after a set delay. That delay is the whole point: it stops a rushed request turning into a rushed theft.

Sharing that isn't sharing passwords. You want the ability to put a set of credentials in a folder and give three people access, then take one person's access away without changing the password for everyone else. If the product can only do "one login, one person", it'll fight you the first time someone goes on holiday.

A decent browser extension and a mobile app. If it's awkward on the phone, people will keep the sticky note for the phone-only stuff. Which, inevitably, is the banking app.

Straightforward billing in pounds. Sounds trivial until you're reconciling a card statement in dollars against a VAT return.

Single sign-on, if you already have Microsoft 365 or Google Workspace. Being able to log into the vault with the same account people already use every morning removes an entire category of "I've forgotten the master password" ticket.

Week three: migrate in threes

This is where most rollouts go wrong. Don't do a big-bang switchover. Pick three people — ideally the most sceptical three, not the keenest — and give them a week. Each of them moves their own logins across, with 25 minutes of help, and then uses the vault exclusively for seven days.

Why the sceptics? Because they'll find every sharp edge. The portal that doesn't accept a 40-character password. The site that insists on a password you can type without a keyboard. The one that logs you out if it detects a paste. Better they hit those in week three, with three people, than in week five with everybody.

Expect two genuine complaints and one that's really about something else. The genuine ones are usually: "it's slower than the whiteboard" (true for about four days) and "I don't want my personal phone involved" (fair — offer the desktop app and let them use the browser extension instead). The third complaint is almost always about feeling watched. Reassure them that the vault's audit log records access to shared entries, not their individual browsing, and mean it.

Once the three are settled, move the rest in groups of four or five, one week apart. Two months total is a perfectly reasonable timetable for a 20-person firm.

Week four: five rules that survive contact with reality

Policies nobody reads are decoration. These five tend to stick:

1. One master password, remembered, not written down. Backed by multi-factor authentication on the vault itself. No exceptions, including for the managing director.
2. If it's not in the vault, it doesn't exist. Not a rule about punishment — a rule about the default. If someone creates a new account, it goes in the vault the same day, or it gets chased at the next team meeting.
3. Two named people hold admin rights. Not one, and not everyone. And both are recorded somewhere outside the vault in a sealed envelope in the safe, for the genuine catastrophe scenario.
4. Leavers lose access on their last day, not their last week. Access removal is part of the leaving checklist, alongside the laptop and the key fob.
5. The whiteboard comes down. Take a photo of it first, migrate everything on it, then wipe it and put the marker pen in a drawer. If it stays up, it will quietly refill within a month.

What actually goes wrong

Someone will keep a personal password list "just in case". Someone will share a vault entry's password by pasting it into Teams. Someone will set up a new supplier account and not tell anyone. None of that means the rollout failed — it means it's a rollout, and rollouts need a bit of gentle maintenance.

A short item in the monthly team meeting — "anything new gone into the vault this month?" — does more for adoption than any amount of training slides. And when you eventually run a Cyber Essentials assessment or answer an insurer's questionnaire, you'll find that "we use a password manager with MFA and documented emergency access" is a line you can write without flinching.

The password was never really the problem. The problem was that only one person knew it. Fix that, and the rest follows.