Answers

Does a small business need a password manager?

Ascent Vision · Published October 28, 2026

Usually, yes. CISA's guidance for small businesses says to provide a company-wide password manager, which generates complex passwords, fills them in and stores them securely, so each person remembers one master password. A shared spreadsheet is usually the weaker version of the same idea. The business, not one employee, should hold the master login, so that a leaver cannot take the only copy of its logins with them.

What a password manager does

CISA's guidance for small businesses says to provide a company-wide password manager. It says the manager generates complex passwords, fills them in automatically and stores them securely, so employees only need to remember one strong master password. CISA says this helps prevent password reuse, weak passwords and accidental breaches.

The same page describes strong passwords as long (at least 16 characters, and more is better), random and unique. A CISA training page on password managers, written for individuals, says it is not practical for a person to remember all of their passwords, and that password managers were created to solve that problem.

Shared logins, and why a spreadsheet falls short

Small businesses often have logins that several people use, such as a booking tool, a supplier portal or the social accounts. The common fix is a shared spreadsheet or a note. CISA's training page on password managers says storing passwords as plaintext in a physical or digital notes app "isn't a safe option", and its list of things not to do includes keeping passwords saved in a file that could be easily accessed on your device.

Why a spreadsheet falls short is general advice, not CISA's: anyone who can open the file can usually read every password, copies tend to spread through email and laptops, there is often no record of who looked, and removing one person's access can mean changing every password in the sheet.

Where a service lets each person have their own login, that is usually better than sharing one, as the related answer on removing an employee's access explains. A manager suits the logins that must be shared.

Who holds the master login, and the leaver problem

The master password opens everything, so the business should hold it, not one employee. As general advice: open the account in the owner's name, keep at least two trusted people able to get in, and keep recovery details written down and locked away where the owner can reach them. CISA's business page says to pair strong passwords with multifactor authentication, as the related answer on multi-factor authentication explains. Its training page says a password manager should have a master password that you cannot lose, and advises understanding how the master password and account recovery work.

Now suppose a leaver held the only copy, in their head, a personal notebook or their own browser's saved passwords. The business may then be unable to get into the booking tool, the ad account or the website host without them. That is a risk, not a certainty. Move the logins into the business account now, before anyone leaves. If someone is leaving or being dismissed, change the shared passwords they knew at the moment they are told; the same-day list in the related answer on removing an employee's access covers the rest.

What to ask a product

CISA's training page on password managers lists considerations that include where the password database is stored, whether the app works on all your devices, how the master password and account recovery work, and whether the manager offers multifactor authentication to get into it. This answer names no product. These questions are general advice for any product:

• Can the business own the account, with an owner who can see who has access and remove someone?
• Can a login be shared with chosen people and taken back later?
• What happens if the master password is forgotten, and who controls recovery?
• Does its own sign-in support a second step, such as an app code or a key?
• Does it flag weak or reused passwords?
• Can everything stored be exported in a usable form, and what happens to it if the plan ends?

One of four essentials

CISA lists strong passwords as one of four essentials for small businesses. The related answer on small business cybersecurity basics covers the rest.

Sources

1. CISA, "Require Strong Passwords" (Secure Your Business)
2. CISA, "Cyb3R_Sm@rT!: Use a Password Manager to Create and “Remember” Strong Passwords" (Project Upskill training, written for individuals)

Related answers

• What are the basic cybersecurity steps for a small business?
• What is multi-factor authentication, and should every business account use it?
• How do you remove an employee's access to accounts when they leave?