| A password manager is software that stores every login a business uses in an encrypted vault, so staff need to remember only one master password. The business versions add shared vaults for team logins, an admin console for granting and removing access, and a record of who opened what. |
A staff member leaves on the Friday. By Monday somebody needs the login for the courier account, and the only person who knew it has handed back their laptop.
It turns up eventually in a spreadsheet called Logins on the shared drive, last edited in 2023. Three of the passwords in it still work.
This is the ordinary state of credentials in a small business, and it is nobody’s fault. Every account arrived separately, each one needed a password, and whoever set it up stored it wherever was quickest that day.
Most businesses reach the same point the same way. An account locks, or an accountant asks for a login nobody can find, and the spreadsheet stops being acceptable.
The cost is easy to underestimate, in both directions. Licences for a small team are a minor line in an IT budget. One redirected invoice, paid because an attacker was sitting in a mailbox with a working login, can cost more in an afternoon than the tool costs in a year.
The tool itself is cheap. Rollout is the step most businesses skip, and skipping it is why the licence ends up paying for something nobody opens.
What Is a Password Manager?
A password manager is an application that generates and stores passwords, then fills them in, keeping them encrypted behind one master password that only the user knows. The business versions add the parts a company needs, which are shared vaults and central administration, with an audit trail behind both. Credential management is the term you will see in proposals, and the vault is the part of it staff actually touch.
New Zealand’s National Cyber Security Centre treats it as a control in its own right. Its guidance on password managers describes the tool as the most effective way to enable staff to use unique and strong passwords, and says that in combination with multi-factor authentication it will prevent most unauthorised access incidents.
Building the master password itself is a separate question. Our post on secure passwords covers length and passphrases, and what makes one hard to crack.
Can your IT administrator see everyone’s passwords?
Not by browsing them, but the honest answer depends on the product and on how you configure it. An administrator can normally see which accounts exist, who belongs to which shared vault, and when a password was viewed. Access to shared credentials is governed by vault permissions. A private work vault is encrypted with a key derived from that person’s master password, so it cannot simply be opened from the console.
Where the plan allows it, an authorised recovery process can restore access to an individual work vault. That is a deliberate business control rather than a hole, and it is the same mechanism described further down under a forgotten master password. It restores access rather than revealing the original password, and it should leave a record.
Decide three things during the rollout and write them into the staff guide: what administrators can reach, who may approve a recovery, and whether personal credentials belong in the work account at all. Staff are entitled to know the answer before they start storing anything.
Turn logging on for every view and every share. Where a credential cannot be unique to one person, that log is the only traceability you have.
Owners underuse the audit trail. Once shared credentials sit in vaults with named members, the question of who could have reached an account stops being guesswork and becomes a report.
What else belongs in the vault besides passwords?
Anything short and secret that people currently write down. PIN numbers and multi-factor authentication recovery codes belong here, and the recovery codes are the ones businesses regret losing.
Bank token serials, alarm codes, licence keys and the answers to security questions all qualify. Security answers are worth generating at random and storing, because a truthful answer to your mother’s maiden name is public information.
How does it differ from the one built into your browser?
A browser holds credentials for sites you sign into through that browser, and nothing else. That is why browser password storage does not stretch to a business.
The gap appears the moment a login is not a website. A wifi passphrase, a door PIN, a bank token, the SIM PIN for the site mobile, none of those live in a browser.
Why browser storage is a policy problem as well as a technical one is covered in our post on browser security.
How Do You Share Logins a Whole Team Needs?
Through a shared vault, which is the feature that separates a business tool from a personal one. Some accounts cannot be split into one login per person, and those are the ones that end up in a spreadsheet.
Service accounts and social media accounts cause most of it, because the platform issues one set of credentials and expects one person to hold them.
Which accounts belong in a shared vault?
The ones where the business is the account holder and the platform issues only one credential. Where a service supports named individual users, use those instead. A shared login destroys the record of who did what, and that record is usually the reason you wanted the vault in the first place. Accounting, payroll and banking are the clearest cases for named users, so they belong in a shared vault only where the system offers no alternative.
With that settled, a short list covers most firms.
- Social media accounts, where the platform allows a single login
- Service and supplier portals billed to the business
- The wifi passphrase, and any router or firewall admin login
- Any accounting or payroll system that issues one credential and cannot be given named users
- Domain name and website hosting, which nobody touches until it expires. Holding those logins yourself is the first step in domain name management
Each of those sits in a vault with named members, so withdrawing somebody’s access through the password manager takes one action. That is not the whole of offboarding. Removing vault membership does not change a password the person has already read, and it does not end a session already open in the service that password unlocks, so shared credentials they could reach still need rotating and active sessions revoking.
Not everything belongs in there. Personal logins should stay out, and so should any account where the platform supports individual users, because sharing one login destroys the record of who did what.
Payroll and banking are where this gets argued. Where a system allows named users, use them, and keep the shared vault for the accounts that allow only one credential.
How do you give a supplier access without handing over the password?
Where the service supports it, the right answer is a named account for the supplier carrying only the permissions they need, which you disable when the job ends. Where a shared credential is unavoidable, use the tool’s own sharing method and set the share to expire.
Treat the recipient as knowing the password either way. Most business tools can hide a credential from view while still filling it, but a password filled on somebody’s device can be recovered from it, so hiding it is a convenience rather than a boundary. An expiry stops further use through the vault; it cannot un-know a password somebody already has. That covers the contractor who needs a supplier portal for one job, and the same logic applies to anything more sensitive.
Check how a tool handles sharing outside the business before you buy. It comes up more often than owners expect.
The alternative is what happens now, where the password goes out by email and is never changed afterwards. Anything shared that way should be rotated the moment the job ends. A vault makes it easy to find every credential that needs changing, though the change itself still has to be made in each service unless the tool integrates with it directly.
How Do You Roll One Out Across a Team?
In stages. A pilot group first, then team by team, which is the only sequence that survives contact with a busy office.
Choose the tool and decide cloud or self-hosted
Cloud suits almost every small business. Self-hosting means nobody else holds your vault data, but you still depend on the vendor’s software and you take on the patching, backups and recovery, which somebody has to own.
Configure it before anyone logs in
Set the master password policy, require multi-factor authentication, turn on logging, and decide whether staff may keep personal logins in the work vault.
Run a pilot with three or four people
Ask what confused them, then write the staff guide out of their answers.
Enrol team by team
Each person installs the app and sets a master password, then adds their key accounts as they go.
Clear the old hiding places
Import and then delete browser-saved passwords, and delete the spreadsheet.
Fold it into onboarding
A new starter gets a vault on day one, the same way they get an email address.
Requiring multi-factor authentication on the vault is the single most important setting in that list, because the master password becomes the key to everything else.
What should you configure before anyone logs in?
The settings that are awkward to change later. Master password rules, mandatory multi-factor authentication, audit logging, and whether master passwords can be reset at all.
The NCSC advises against allowing a master password reset without multi-factor authentication, because reset functions are a common way to bypass authentication.
Single sign-on suits ordinary staff accounts. Keep it off the administrator accounts, which are the ones able to reach everything.
What should the staff guide say?
Less than people expect. One page covering how to install it, how to set a master password, how to add a login, and who to ask when something does not fill.
Write it after the pilot, in the words the pilot group used. A guide written before anybody has touched the tool answers questions nobody asked.
Keep it to one page. A guide running to six will be read by nobody, and it dates the first time the vendor moves a menu.
What happens to passwords already saved in browsers?
They get imported once and then deleted. Businesses do the importing and forget the deleting, and a password sitting in both places is still exposed in the weaker one.
Set a date, import everything, then turn off the browser’s own save prompt across the fleet so it does not start refilling.
Will Your Staff Actually Use It?
Only if it is easier than what they do now. Every rollout passes or fails on that test. The NCSC is direct about it, warning that a tool too difficult to use will not be adopted and that widespread use needs buy-in from everyone.
Nobody in a small business has spare attention for learning a security tool. The rollout has to fit around the actual job, and a pilot is how you find out where it does not.
Refusal is rare. The usual failure is a slow fork, where the vault holds the logins somebody added in week one and everything since has gone back into the browser.
Two things prevent that. Browser saving turned off across the fleet, so there is no easier path, and a named person who checks adoption a month after enrolment.
How do you tell whether it is working?
Count how many of the people in scope have activated the tool and are using it, and name the ones who have not. Then count the credentials sitting in shared vaults against the shared accounts the business knows it has. Neither number settles permanently, because people join and leave and accounts keep being created, so the question at each review is whether everyone with access is still authorised and still needs it.
If we run the rollout, these are the checks we report against, and they are worth asking any provider for.
- Staff adoption. The percentage of in-scope staff activated and using the tool, with the outstanding users named.
- Vault protection. Confirmation that the required multi-factor authentication policies are enforced, with any exceptions documented.
- Shared account coverage. The agreed shared accounts assigned to the correct vaults, with owners and members recorded.
- Recovery. A recorded recovery test and its outcome.
- Offboarding. A completed offboarding test covering vault access, service access and the password changes that followed.
Success looks dull from the outside. Every member of staff has the tool, uses it, and the shared credentials are logged.
If adoption stalls at half the team, the tool is rarely the problem. Ask the people who stopped using it what got in the way, and expect the answer to be a phone that would not fill a login.
What Happens If Someone Forgets the Master Password?
The provider cannot recover it, because on a zero-knowledge system they hold no key to your data. Your own organisation may be able to, and that is a separate question.
Business plans answer it with a recovery path an administrator can trigger: a recovery key held by the organisation, an administrator reset permission, or a designated break-glass account. Zero-knowledge encryption describes what the vendor can decrypt. It does not by itself decide what your own authorised administrators can do. Recovery restores access rather than revealing the old password, and what is available depends on the product and the policies you switch on. Set one up during the rollout and test it before you need it.
A business with no recovery path has built a single point of failure into every staff member.
What if someone leaves without handing over access?
Everything the business depends on should already be in a shared vault, which is the point of putting it there. Beyond that, an administrator can reach a departed person’s work vault through the recovery path above, where the product and your policy allow it. Confirm during the rollout that yours does, because finding out after somebody has left is too late.
Access removal and the wider offboarding process are covered in our post on identity and access management.
What Happens If the Vault Provider Gets Breached?
Your passwords stay encrypted, as long as the vendor holds no key and your master password is strong. It has already been tested in public.
In its December 2022 disclosure, LastPass confirmed that an attacker had copied a backup of customer vault data. Website addresses in that backup were unencrypted. Usernames and passwords were encrypted with 256-bit AES and can be decrypted only with a key derived from each user’s master password, which the company says it never stores.
The strength of the master password is what stands between a stolen vault copy and the logins inside it. The site list matters too, because it can leak even when the passwords hold.
If a provider does disclose an incident, the response is mechanical. Change the master password, rotate the credentials for anything sensitive in the vault, and treat the site list as known to somebody else.
That last step matters commercially. Knowing which bank, payroll and supplier portals a business uses is enough to build a convincing phishing email.
How Much Does a Password Manager Cost in New Zealand?
A business password manager is licensed per user and billed annually, with a one-off cost for the rollout on top. The licence is the small half of it. What varies is the work of configuring the tool and getting the team onto it, which is why a quote only becomes comparable once you know which of the two it covers.
| What you pay for | What moves the number |
|---|---|
| Ongoing | |
| Business licencesPer-user vaults, shared vaults, admin console and logging | Staff numbers, and which plan tier carries the sharing, reporting and recovery controls you need |
| Ongoing administrationAdding and removing users, shared vault upkeep, audit review | Usually inside a managed IT agreement |
| One-off | |
| Rollout and configurationPolicy setup, MFA, the pilot, import and browser cleanup | How many shared accounts exist, and how many places credentials are kept today |
| Staff guides and trainingA short written guide and one session per team | Number of teams, and whether sessions run remotely or on site |
The one-off spend is the part worth scrutinising, because it is where quotes differ most and where a cheap number usually means the work has been left with you.
The rollout effort moves with headcount and with how much mess there is to clear. A firm of 40 with three shared spreadsheets takes longer than a firm of 12 with everything already in one place.
Set that against what the current arrangement already costs. Password resets, the shared spreadsheet and the hour lost every time somebody leaves are all being paid for now, just never on an invoice.
Why do quotes differ so much?
Because some quotes price the licence and some price the project. A licence-only number looks cheap and leaves the rollout with you.
Ask each quote what is included: configuration, the pilot, the import, the staff guides, and who removes a user when somebody leaves.
How Do You Choose the Right One?
Shortlist on security features first, then let the people who will use it choose from that shortlist. Narrow to two or three products that clear the security bar, then judge those on whether people can find their way around them.
A tool people find awkward will not get used.
What should you ask a vendor before signing?
- Can you read our stored passwords, and can you show us why not?
- Can a master password be reset without multi-factor authentication?
- What is written to the log when somebody views or shares a password?
- How do we share one credential with an outside supplier, and can that access expire?
- What happens to our vaults if we stop paying?
What should you do this week?
Find the spreadsheet, document or notebook where your business currently keeps shared logins. Most firms have one, and finding it tells you most of what you need to know.
Then list who could still sign into your email, your accounting system and your website today, and check each name against who is currently authorised and actually needs it. The gap between those two lists is the size of the problem, and it is usually wider than anyone expects.
Neither task needs a budget or a decision. They give you the size of the problem, which is what any quote should be priced against.
Get Your Team’s Logins Out of the Spreadsheet
Exodesk has supported New Zealand businesses since 1989, from offices in Christchurch and Dunedin. We choose the tool, configure the policies, run the pilot and enrol your teams, then keep the vaults tidy as people join and leave. It usually sits inside a wider cyber security programme, alongside multi-factor authentication and access control.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
What is a master password?
The master password is the single password a person uses to unlock their own vault. It is the one credential the vault cannot store for you, so it has to be long and memorable, and used nowhere else. On a zero-knowledge system it is also the key that decrypts the data, which is why the provider cannot reset it for you. Depending on the product and the policies your organisation enables, an authorised administrator may be able to trigger a recovery that restores access, which is not the same as revealing the original password.
Can staff use the work vault for personal logins?
That is a policy choice you should make before rollout and write into the staff guide. Many businesses allow it, because staff who keep personal logins somewhere safe are less likely to reuse a password that also protects a work account. Most vendors also offer a free personal version, which is a reasonable middle ground if you would rather keep the two apart.
How long does a rollout take for a 20 person business?
Two to four weeks in practice. Little of that is technical: configuration takes a day, the pilot runs for about a week, and enrolment goes team by team after that. Clearing browser-saved passwords adds a few days, because it needs a pass across every device. Adoption has no fixed duration, which is why the pilot matters.
Do we still need MFA if we have a password manager?
Yes, on both the vault itself and the important accounts inside it. The vault turns one password into the key to everything, so that key needs a second factor. The two work as a pair, and most unauthorised access incidents involve a credential that had neither.
Do passkeys make password managers obsolete?
No, and in practice the two are used together rather than one replacing the other. Passkeys remove the password on services that support them, which is a real gain because there is no password left to phish or reuse, but coverage across the systems a business runs is uneven. A good deal of what a vault holds was never a website password anyway: wifi passphrases, PINs, licence keys, alarm codes and multi-factor recovery codes are all untouched by passkeys. Several password managers can store passkeys as well, so the vault ends up holding both, and our guide to passkeys covers where they fit.
Can we run it on our own server?
Yes, several products can be self-hosted. It moves the trust rather than removing it: nobody else holds your vault data, but you still rely on that vendor’s software and on the operating system and infrastructure underneath it. What it definitely does is transfer the operational responsibility, so patching, backups, monitoring and recovery testing become yours, which is a real workload for a small team. Cloud plans suit most small businesses for that reason.
What is a shared vault?
A shared vault is a folder of credentials with named members, used for accounts owned by the business, not by one person. Typical contents are social media logins, supplier portals and the wifi passphrase. Membership is what you add and remove, so withdrawing access through the vault is one action and nobody else needs a new password. It does not change a password the person already knows, so a departure still needs the shared credentials rotated.
Do these tools work on phones?
Yes. Business plans include mobile apps that autofill logins into apps and browsers on the phone, which matters for staff working away from a desk. Set that up during enrolment, because somebody who can only reach the vault at their desk will be back to old habits inside a week.
What happens to our passwords if we stop paying?
That depends entirely on the provider and the plan, so do not assume a grace period. Some drop the account to a limited or read-only state for a time, and some cut access at the end of the term. Check the specific terms before you commit, because the export path is the thing you will want in a hurry. Ask for it in writing during the sales process.
Who provides password manager rollouts in Christchurch and Dunedin?
Exodesk configures, pilots and rolls out business password tools for organisations across New Zealand, and has operated since 1989. Teams in Christchurch and Dunedin cover both islands. The work is mostly remote, with on-site sessions for staff training where a team prefers it.
What is zero-knowledge encryption?
Zero-knowledge means the provider cannot decrypt what you store, because encryption and decryption happen on your device with a key derived from your master password. It is the property that makes a vendor breach survivable for the vault contents. It does not mean everything a provider holds about you is encrypted: the 2022 LastPass disclosure described above included unencrypted website addresses alongside the encrypted credentials. Worth confirming in writing before you buy, including what sits outside the encrypted vault.
How is this different from a spreadsheet with a password on it?
A protected spreadsheet gives one shared password to everyone who needs any entry in it, no record of who opened it, and no way to remove one person’s access. A vault gives individual accounts and membership per credential, with a log behind it. The spreadsheet also tends to be copied to a desktop and emailed, which the vault removes.
Where should a business start with a password manager?
Start by finding where shared logins currently live, because that tells you the size of the job. Then shortlist two or three tools on security features, and run a pilot with a few staff. Write the guide from whatever confused the pilot group. Enrol the rest team by team once that guide exists.
Did the shared logins ever make it into the vault?
Rollouts stall quietly. The finance login stays in a spreadsheet, somebody keeps using browser autofill, and the vault ends up holding half the business. A free IT assessment shows where credentials actually live and who can still reach them.
Or read more about our cyber security services.
