| A password manager is software that stores every login a business uses in an encrypted vault, so staff need to remember only one master password. The business versions add shared vaults for team logins, an admin console for granting and removing access, and a record of who opened what. |
A staff member leaves on the Friday. By Monday somebody needs the login for the courier account, and the only person who knew it has handed back their laptop.
It turns up eventually in a spreadsheet called Logins on the shared drive, last edited in 2023. Three of the passwords in it still work.
This is the ordinary state of credentials in a small business, and it is nobody’s fault. Every account arrived separately, each one needed a password, and whoever set it up stored it wherever was quickest that day.
Most businesses reach the same point the same way. An account locks, or an accountant asks for a login nobody can find, and the spreadsheet stops being acceptable.
The cost is easy to underestimate. Take an illustrative example: a 25 person firm paying $6 per user a month spends about $1,800 a year on licences. One redirected invoice, paid because an attacker was sitting in a mailbox with a working login, can cost more than that in an afternoon.
The tool itself is cheap. Rollout is the step most businesses skip, and skipping it is why the licence ends up paying for something nobody opens.
What Is a Password Manager?
A password manager is an application that generates and stores passwords, then fills them in, keeping them encrypted behind one master password that only the user knows. The business versions add the parts a company needs, which are shared vaults and central administration, with an audit trail behind both. Credential management is the term you will see in proposals, and the vault is the part of it staff actually touch.
New Zealand’s National Cyber Security Centre treats it as a control in its own right. Its guidance on password managers describes the tool as the most effective way to enable staff to use unique and strong passwords, and says that in combination with multi-factor authentication it will prevent most unauthorised access incidents.
Building the master password itself is a separate question. Our post on secure passwords covers length and passphrases, and what makes one hard to crack.
Can your IT administrator see everyone’s passwords?
No, and that boundary is deliberate. An administrator can see which accounts exist, who belongs to which shared vault, and when a password was viewed. They cannot read a private vault, because the key that decrypts it comes from that person’s master password and never leaves their device.
A business gets control over access without anyone gaining a window into an individual’s stored logins.
Turn logging on for every view and every share. Where a credential cannot be unique to one person, that log is the only traceability you have.
Owners underuse the audit trail. Once shared credentials sit in vaults with named members, the question of who could have reached an account stops being guesswork and becomes a report.
What else belongs in the vault besides passwords?
Anything short and secret that people currently write down. PIN numbers and multi-factor authentication recovery codes belong here, and the recovery codes are the ones businesses regret losing.
Bank token serials, alarm codes, licence keys and the answers to security questions all qualify. Security answers are worth generating at random and storing, because a truthful answer to your mother’s maiden name is public information.
How does it differ from the one built into your browser?
A browser holds credentials for sites you sign into through that browser, and nothing else. That is why browser password storage does not stretch to a business.
The gap appears the moment a login is not a website. A wifi passphrase, a door PIN, a bank token, the SIM PIN for the site mobile, none of those live in a browser.
Why browser storage is a policy problem as well as a technical one is covered in our post on password best practices.
How Do You Share Logins a Whole Team Needs?
Through a shared vault, which is the feature that separates a business tool from a personal one. Some accounts cannot be split into one login per person, and those are the ones that end up in a spreadsheet.
Service accounts and social media accounts cause most of it, because the platform issues one set of credentials and expects one person to hold them.
Which accounts belong in a shared vault?
The ones where the business is the account holder. A short list covers most firms.
- Social media accounts, where the platform allows a single login
- Service and supplier portals billed to the business
- The wifi passphrase, and any router or firewall admin login
- Accounting and payroll logins used by more than one person
- Domain name and website hosting, which nobody touches until it expires
Each of those sits in a vault with named members, so removing somebody takes one action.
Not everything belongs in there. Personal logins should stay out, and so should any account where the platform supports individual users, because sharing one login destroys the record of who did what.
Payroll and banking are where this gets argued. Where a system allows named users, use them, and keep the shared vault for the accounts that allow only one credential.
How do you give a supplier access without handing over the password?
Most business tools can share an item so the other person can use it without seeing it, and can set that share to expire on a date. This covers the accountant who needs the payroll login for a fortnight and the contractor who needs a portal for one job.
Check how a tool handles sharing outside the business before you buy. It comes up more often than owners expect.
The alternative is what happens now, where the password goes out by email and is never changed afterwards. Anything shared that way should be rotated the moment the job ends, and a vault turns that into one action.
How Do You Roll One Out Across a Team?
In stages. A pilot group first, then team by team, which is the only sequence that survives contact with a busy office.
- Choose the tool and decide cloud or self-hosted. Cloud suits almost every small business, while self-hosting removes a third party and adds maintenance somebody has to own.
- Configure it before anyone logs in. Set the master password policy, require multi-factor authentication, turn on logging, and decide whether staff may keep personal logins in the work vault.
- Run a pilot with three or four people. Ask what confused them, then write the staff guide out of their answers.
- Enrol team by team. Each person installs the app and sets a master password, then adds their key accounts as they go.
- Clear the old hiding places. Import and then delete browser-saved passwords, and delete the spreadsheet.
- Fold it into onboarding. A new starter gets a vault on day one, the same way they get an email address.
Requiring multi-factor authentication on the vault is the single most important setting in that list, because the master password becomes the key to everything else.
What should you configure before anyone logs in?
The settings that are awkward to change later. Master password rules, mandatory multi-factor authentication, audit logging, and whether master passwords can be reset at all.
The NCSC advises against allowing a master password reset without multi-factor authentication, because reset functions are a common way to bypass authentication.
Single sign-on suits ordinary staff accounts. Keep it off the administrator accounts, which are the ones able to reach everything.
What should the staff guide say?
Less than people expect. One page covering how to install it, how to set a master password, how to add a login, and who to ask when something does not fill.
Write it after the pilot, in the words the pilot group used. A guide written before anybody has touched the tool answers questions nobody asked.
Keep it to one page. A guide running to six will be read by nobody, and it dates the first time the vendor moves a menu.
What happens to passwords already saved in browsers?
They get imported once and then deleted. Businesses do the importing and forget the deleting, and a password sitting in both places is still exposed in the weaker one.
Set a date, import everything, then turn off the browser’s own save prompt across the fleet so it does not start refilling.
Will Your Staff Actually Use It?
Only if it is easier than what they do now. Every rollout passes or fails on that test. The NCSC is direct about it, warning that a tool too difficult to use will not be adopted and that widespread use needs buy-in from everyone.
Nobody in a small business has spare attention for learning a security tool. The rollout has to fit around the actual job, and a pilot is how you find out where it does not.
Refusal is rare. The usual failure is a slow fork, where the vault holds the logins somebody added in week one and everything since has gone back into the browser.
Two things prevent that. Browser saving turned off across the fleet, so there is no easier path, and a named person who checks adoption a month after enrolment.
How do you tell whether it is working?
Count active users against headcount, then count the credentials sitting in shared vaults against the number of shared accounts the business knows it has. Both numbers should stop moving once the rollout finishes.
Success looks dull from the outside. Every member of staff has the tool, uses it, and the shared credentials are logged.
If adoption stalls at half the team, the tool is rarely the problem. Ask the people who stopped using it what got in the way, and expect the answer to be a phone that would not fill a login.
What Happens If Someone Forgets the Master Password?
On a zero-knowledge system nobody can recover it for them. You accept that in exchange for the provider holding no key to your data.
Business plans answer this with recovery an administrator can trigger, such as a recovery key held by the organisation or a designated break-glass account. Set one up during the rollout and test it before you need it.
A business with no recovery path has built a single point of failure into every staff member.
What if someone leaves without handing over access?
Their private vault stays sealed, and everything the business depends on should already be in a shared vault. Recovery lets an administrator reach a departed person’s vault where the plan allows it.
Access removal and the wider offboarding process are covered in our post on identity and access management.
What Happens If the Vault Provider Gets Breached?
Your passwords stay encrypted, as long as the vendor holds no key and your master password is strong. It has already been tested in public.
In its December 2022 disclosure, LastPass confirmed that an attacker had copied a backup of customer vault data. Website addresses in that backup were unencrypted. Usernames and passwords were encrypted with 256-bit AES and can be decrypted only with a key derived from each user’s master password, which the company says it never stores.
The strength of the master password is what stands between a stolen vault copy and the logins inside it. The site list matters too, because it can leak even when the passwords hold.
If a provider does disclose an incident, the response is mechanical. Change the master password, rotate the credentials for anything sensitive in the vault, and treat the site list as known to somebody else.
That last step matters commercially. Knowing which bank, payroll and supplier portals a business uses is enough to build a convincing phishing email.
How Much Does a Password Manager Cost in New Zealand?
Budget $4 to $10 per user per month for a business password manager, billed annually, plus a one-off cost for the rollout.
| What you pay for | What it covers | Typical range |
|---|---|---|
| Business licences | Per-user vaults, shared vaults, admin console and logging | $4 to $10 per user per month |
| Rollout and configuration | Policy setup, MFA, the pilot, import and browser cleanup | $1,200 to $4,000 one-off |
| Staff guides and training | A short written guide and one session per team | $400 to $1,200 one-off |
| Ongoing administration | Adding and removing users, shared vault upkeep, audit review | Usually inside a managed IT agreement |
Those are the ranges we see quoted in the South Island market. The licence is cheap. The one-off spend is the number worth scrutinising.
The one-off figures move with headcount and with how much mess there is to clear. A firm of 40 with three shared spreadsheets takes longer than a firm of 12 with everything already in one place.
Set that against what the current arrangement already costs. Password resets, the shared spreadsheet and the hour lost every time somebody leaves are all being paid for now, just never on an invoice.
Why do quotes differ so much?
Because some quotes price the licence and some price the project. A licence-only number looks cheap and leaves the rollout with you.
Ask each quote what is included: configuration, the pilot, the import, the staff guides, and who removes a user when somebody leaves.
How Do You Choose the Right One?
Shortlist on security features first, then let the people who will use it choose from that shortlist. Narrow to two or three products that clear the security bar, then judge those on whether people can find their way around them.
A tool people find awkward will not get used.
What should you ask a vendor before signing?
- Can you read our stored passwords, and can you show us why not?
- Can a master password be reset without multi-factor authentication?
- What is written to the log when somebody views or shares a password?
- How do we share one credential with an outside supplier, and can that access expire?
- What happens to our vaults if we stop paying?
What should you do this week?
Find the spreadsheet, document or notebook where your business currently keeps shared logins. Most firms have one, and finding it tells you most of what you need to know.
Then count how many people could still sign into your email, your accounting system and your website today. If that number is larger than your headcount, the vault is the cheapest fix on your list.
Neither task needs a budget or a decision. They give you the size of the problem, which is what any quote should be priced against.
Get Your Team’s Logins Out of the Spreadsheet
Exodesk has supported South Island businesses since 1989 and works with organisations across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. We choose the tool, configure the policies, run the pilot and enrol your teams, then keep the vaults tidy as people join and leave. It usually sits inside a wider cyber security programme, alongside multi-factor authentication and access control.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
What is a master password?
The master password is the single password a person uses to unlock their own vault. It is the one credential the vault cannot store for you, so it has to be long and memorable, and used nowhere else. On a zero-knowledge system it is also the key that decrypts the data, which is why nobody can reset it on your behalf.
Can staff use the work vault for personal logins?
That is a policy choice you should make before rollout and write into the staff guide. Many businesses allow it, because staff who keep personal logins somewhere safe are less likely to reuse a password that also protects a work account. Most vendors also offer a free personal version, which is a reasonable middle ground if you would rather keep the two apart.
How long does a rollout take for a 20 person business?
Two to four weeks in practice. Little of that is technical: configuration takes a day, the pilot runs for about a week, and enrolment goes team by team after that. Clearing browser-saved passwords adds a few days, because it needs a pass across every device. Adoption has no fixed duration, which is why the pilot matters.
Do we still need MFA if we have a password manager?
Yes, on both the vault itself and the important accounts inside it. The vault turns one password into the key to everything, so that key needs a second factor. The two work as a pair, and most unauthorised access incidents involve a credential that had neither.
Can we run it on our own server?
Yes, several products can be self-hosted. It removes the need to trust an outside provider and hands you the maintenance and patching instead, which is a real workload for a small team. Cloud plans suit most small businesses for that reason.
What is a shared vault?
A shared vault is a folder of credentials with named members, used for accounts owned by the business, not by one person. Typical contents are social media logins, supplier portals and the wifi passphrase. Membership is what you add and remove, so an access change is one action and nobody else needs a new password.
Do these tools work on phones?
Yes. Business plans include mobile apps that autofill logins into apps and browsers on the phone, which matters for staff working away from a desk. Set that up during enrolment, because somebody who can only reach the vault at their desk will be back to old habits inside a week.
What happens to our passwords if we stop paying?
Most vendors drop the account to a read-only or limited state for a period, so you can still export your data, then restrict access after that. Check the specific terms before you commit, because the export path is the thing you will want in a hurry. Ask for it in writing during the sales process.
Who provides password manager rollouts in Christchurch and Dunedin?
Exodesk configures, pilots and rolls out business password tools for organisations across Canterbury, Otago and Southland, and has operated in the South Island since 1989. The work is mostly remote, with on-site sessions for staff training where a team prefers it.
What is zero-knowledge encryption?
Zero-knowledge means the provider cannot decrypt what you store, because encryption and decryption happen on your device with a key derived from your master password. The provider holds only encrypted data. It is the property that makes a vendor breach survivable, and it is worth confirming in writing before you buy.
How is this different from a spreadsheet with a password on it?
A protected spreadsheet gives one shared password to everyone who needs any entry in it, no record of who opened it, and no way to remove one person’s access. A vault gives individual accounts and membership per credential, with a log behind it. The spreadsheet also tends to be copied to a desktop and emailed, which the vault removes.
Where should a business start with a password manager?
Start by finding where shared logins currently live, because that tells you the size of the job. Then shortlist two or three tools on security features, and run a pilot with a few staff. Write the guide from whatever confused the pilot group. Enrol the rest team by team once that guide exists.
