The average person now has well over a hundred online accounts, and the average employee has dozens that touch the business. No human being can hold that many strong, unique passwords in their head, so people do the sensible thing from their point of view: they reuse a few passwords, tweak them slightly, and write down the rest. From a security point of view, that is exactly the pattern attackers rely on.
Why Reuse Is the Real Problem
When a third-party website is breached, the stolen email-and-password pairs end up in lists that are traded and automatically tried against other services — a technique known as credential stuffing. If an employee used the same password for a forum, a supplier portal and your Microsoft 365 login, the breach of the forum becomes a breach of your business, and nothing about your own security was involved.
This is why "make passwords complex" was never really the answer. A complicated password that is reused is far weaker than a random one used in exactly one place. A password manager solves the actual problem: it makes unique passwords effortless.
What the NCSC says: The UK's National Cyber Security Centre recommends password managers for both individuals and organisations, precisely because they let people use a different strong password for every service without having to memorise any of them.
What a Business Password Manager Actually Does
- Generates and stores unique passwords for every account, filling them in automatically so staff don't type or remember them.
- Shares credentials safely. Shared logins — the social media account, the supplier portal, the Wi-Fi admin page — can be shared with named people without anyone pasting a password into chat or email.
- Revokes access cleanly. When someone leaves, you remove their access to the vault rather than hoping nobody remembers the shared password. This is a big part of a proper offboarding process.
- Flags weak, reused and breached passwords across the business, giving you a to-do list instead of a guess.
- Provides an admin view and audit trail — who has access to what, and what changed — which is something a spreadsheet can never give you.
Browser-Saved Passwords vs a Proper Manager
Most browsers offer to save passwords, and that is better than a sticky note. But browser-saved passwords are typically tied to an individual's profile, offer little in the way of business-level sharing, admin control or reporting, and are a frequent target for information-stealing malware. For a business, the missing piece is control: you cannot see, enforce or revoke anything centrally.
What to Look For
- Central administration — the ability to add and remove users, set policies and see usage across the business.
- Secure sharing with sensible permissions, so you can share a login without sharing the ability to see everything else.
- Multi-factor authentication on the vault itself. The manager is now the key to everything, so it deserves the strongest protection. See our guide to MFA.
- Breach monitoring that tells you when a stored credential appears in a known leak.
- Straightforward recovery arrangements for the administrator, so the business is never locked out of its own vault.
Is Putting Everything in One Place Risky?
It's the most common objection, and it's a fair question. The answer is that you are comparing the risk of a well-protected, encrypted vault with MFA against the risk of reused passwords and shared spreadsheets — and the second is considerably worse in practice. The vault's contents are encrypted, and a reputable provider cannot read them. The residual risk lies in a weak master password or an unprotected admin account, both of which are easy to address.
Rolling It Out Without a Fight
- Start with the administrators and finance. The accounts that matter most go in first.
- Import what already exists. Most tools can import from browsers, which removes the biggest barrier — retyping everything.
- Make it the easy path. Browser extensions and mobile apps mean staff log in with a click rather than a lookup.
- Explain why. Staff who understand that reuse is the real risk are far more willing to change habits than staff who were simply told to.
- Retire the old methods. Once the manager is live, the spreadsheet and the notebook need to go, or they will quietly remain the real system.
Questions worth asking your IT provider: Where do our shared credentials live today? If a member of staff left this week, how confident are we that they could not still log in to something? Do we know which of our accounts are using reused or already-breached passwords?
The Bottom Line
A password manager will not stop every attack, but it removes the weakest link in most small businesses: human memory. Combined with MFA, it closes off the most common route attackers use to get in.