A password manager is an encrypted vault that generates and stores a unique, random password for every account, unlocked by one strong master password plus multi-factor authentication. It replaces the spreadsheet, the notebook and the reused password — and it is the control that makes every other password-based defence actually work. Verizon's 2025 Data Breach Investigations Report puts stolen credentials in roughly one in five breaches (full report PDF), and credential reuse is what lets a password stolen from a shopping site open a Microsoft 365 mailbox. This guide explains what password managers do, why small businesses need one, how to roll one out without staff revolt, and where the honest limits are.
TL;DR
- A password manager generates and stores a unique, random password for every account in an encrypted vault.
- It kills credential reuse, which is what lets one leaked password unlock a whole business.
- Rollout is cheap and fast: business tier, SSO or MFA on the vault, staff trained in one short session.
- Honest limits: the master password, recovery process and vault sharing rules need care, and an infostealer can still drain a browser's built-in saver.
- A company vault is the business control; a browser's "save password" is not.
What a password manager does
A password manager is an encrypted vault app that does two jobs:
- Generates a long, random, unique password for every account — nobody has to invent or remember them.
- Stores them behind one master password plus MFA, and autofills them on the right sites only.
The staff member remembers one strong passphrase and carries an authenticator or hardware key. Every service behind it gets a password no human chose and no other site shares.
Two things people confuse with a password manager:
| Password manager | Browser "save password" | |
|---|---|---|
| Storage | Encrypted vault with MFA | Plaintext-adjacent browser profile |
| Reuse protection | Generates unique passwords | Saves whatever the staff member typed |
| Sharing | Secure shared vaults for team credentials | None |
| Breach blast radius | One master password, MFA-gated | One infostealer drains the lot |
| Offboarding | Revoke vault access same day | Passwords stay on the laptop |
Why small businesses need one
- Credential reuse is the breach multiplier. A password stolen from a 2019 forum leak still opens a Microsoft 365 mailbox if the staff member reused it. Verizon's 2025 report puts stolen credentials in roughly one in five breaches (full report PDF); unique passwords break that chain.
- It makes MFA practical. Unique passwords per service remove the "I can't remember another one" excuse that pushes staff toward SMS codes and shared logins.
- Shared credentials stop living in spreadsheets. Supplier portals, social accounts and legacy systems get a shared vault with per-person access — and access is revoked the day someone leaves.
- Offboarding becomes one action. Deactivate the vault account and every saved password stays behind.
- Infostealers lose their payday. Malwarebytes' June 2026 analysis describes infostealers becoming the go-to phishing payload: instead of a link to a fake login page, the message delivers a small program that empties the browser's saved passwords, cookies and session tokens (Malwarebytes, June 2026). One staff laptop can hand over credentials for every service it ever remembered.
How to roll one out without staff revolt
- Pick a business tier — 1Password Business, Bitwarden, Bitwarden Secrets, or your platform's bundled option. Consumer free tiers lack the admin and recovery features a business needs.
- One short training session. Install, generate, autofill, save to vault. Twenty minutes, not a policy document.
- MFA on the vault itself. Authenticator app or hardware key on the master credential.
- Shared vaults for shared logins. Supplier portals, legacy systems, social accounts — move them in with per-person access, then stop emailing passwords.
- Phase out browser saving. Set policy in the browser to disable native password saving once the vault is live.
- Plan recovery before it's needed. Admin-assisted recovery for a lost master password, documented and tested once.
- Review quarterly. Check for weak or reused passwords still in circulation, and vault items owned by leavers.
A password manager pairs naturally with the rest of the identity stack — see what is multi-factor authentication for the MFA side, and what is credential harvesting for the attack it defends against.
The honest limits
- The master password is the single point of failure — make it a long passphrase, put MFA on it, and rehearse recovery. Recovery without it means the vault is unrecoverable; recovery with a weak process means the attacker gets everything.
- Vault sharing needs rules. Shared items should live in shared vaults with per-person access, not be passed around in chat.
- Browser-saved passwords remain the weak point. Info-stealers target the browser profile, not the vault; get staff out of the browser saver.
- It does not fix phishing. A password manager autofills only on the real domain — a genuine help — but real-time proxy kits still capture what is typed into them. Pair with phishing simulations so the address-bar habit forms before the attack.
- It does not fix process. Bank-detail changes still need the callback rule — a password manager cannot stop a staff member who verifies a fraudster's email by replying to it.
FAQ
What is a password manager in simple terms? An encrypted vault that generates and stores a unique, random password for every account, unlocked by one strong master password plus MFA.
Is it safe to put all passwords in one place? Yes, when the vault is encrypted and MFA-gated — the alternative, reuse and spreadsheets, has a far worse track record. The risk concentrates, but it becomes manageable instead of scattered.
Which one should we pick? A business tier with admin controls and recovery: 1Password Business, Bitwarden, Keeper or your platform's bundled option. Avoid consumer free tiers for business use.
Does a password manager stop phishing? It helps — autofill only fires on the real domain — but real-time proxy kits still capture typed credentials. Pair it with trained staff and phishing simulations for the complete answer.
What if the person with the master password leaves? Admin-assisted recovery covers it — that is exactly why a business tier matters. Rehearse the process once before you need it.
Should we still use MFA if we have a password manager? Yes — they solve different problems. The vault makes every password unique; MFA makes a stolen password alone useless. Run both.
One last thing
Roll out to finance and admin staff first — they hold the credentials attackers want. A gap assessment shows where password hygiene sits among your other gaps, ranked, so the next hour of security work goes to the weakest control.