Rolling Out a Password Manager to Staff: A 2-Week Plan

Before you start: pick the plan and the owner

Choose the product and the plan first, because recovery and admin features differ. Our 1Password vs Bitwarden comparison has October 2026 prices: Bitwarden Teams is US$4 and Enterprise US$6 per user a month billed yearly; 1Password Business is US$8.99 per user a month. If you're still deciding whether you need one, start with our password manager guide for small businesses.

• Owner: one person runs the rollout and answers questions for two weeks. Usually the office manager or whoever handles IT.
• Admins: at least two, so the business is never locked out of its own account.
• Recovery: confirm your plan includes admin account recovery. 1Password includes it on business plans; Bitwarden puts it on Enterprise.
• Sign-in: decide whether staff unlock with a master password or sign in with Microsoft or Google (SSO), where your plan supports it.

The 2-week password manager rollout plan

Two weeks is enough for a small team if the first week is spent getting the set-up right with a few people, rather than inviting everyone on day one.

1. 1

   Days 1-2: create the account and admins

   Create the business account under a company email, add a second admin, turn on MFA for both, and store the emergency kit or recovery codes somewhere offline and safe.

2. 2

   Days 2-3: build the vault structure

   Create shared vaults or collections by team and purpose (see the next section) and set who can view and who can edit each one.

3. 3

   Days 3-5: pilot with 2-3 people

   Ask a few staff to install the app and browser extension, import their browser passwords and use it for a week. Note every question they ask; that's your training script.

4. 4

   Day 6: fix what the pilot found

   Adjust vault names and permissions, write a one-page how-to, and decide the date the spreadsheet will be deleted.

5. 5

   Days 8-9: staff session and invitations

   Run a 30-minute session (outline below), then send invitations. Everyone installs, sets a master password or SSO, and turns on MFA during the session.

6. 6

   Days 9-11: import, then clear the browser

   Each person imports from Chrome or Edge, deletes the CSV file, turns off the browser's password saving and deletes saved passwords from the browser.

7. 7

   Days 11-12: move shared logins out of the spreadsheet

   The owner moves each shared login into the right vault, changes any password that many people have seen, and enables MFA where the service supports it.

8. 8

   Days 13-14: delete the spreadsheet and check adoption

   Delete the old spreadsheet and any copies, then run the adoption checks in the last section.

Vault structure: shared vaults by team, not one big vault

A single shared vault for everything means everyone sees the bank login. Structure vaults around who needs what, with the fewest people able to edit.

Give edit rights to one or two people per vault, and view-and-use rights to the rest. Where a password manager lets people use a password without revealing it, use that for supplier logins staff don't need to read.

Importing from browsers safely

Staff will have years of work passwords saved in Chrome or Edge. Importing them is quick, but the export file is the weak point. 1Password's Chrome import guide asks users to pause backup software before exporting so the unencrypted CSV isn't backed up, and to delete the CSV after importing. Bitwarden's Chrome import guide covers the same browsers, including a direct import option on its desktop apps.

Then stop the browser competing with the password manager. 1Password notes that Chrome keeps filling saved passwords even after you turn off its password manager, so delete the saved passwords from Chrome once you've checked they're in the vault. On managed devices, admins can turn off browser password saving by policy.

The 30-minute staff session

Keep it short and hands-on: everyone has their laptop and phone, and leaves with the app working. CSA's guidance on strong passwords and 2FA is a useful handout: long passphrases and 2FA wherever it's offered.

Recovery, leavers and checking adoption

Write down who can recover an account and test it once with the pilot group. If your plan has no admin recovery, make sure each person stores their own recovery code safely, because a forgotten master password can mean a lost personal vault.

The password manager also makes offboarding faster: removing a leaver from the organisation cuts off shared vaults immediately. Add it to your employee offboarding checklist, and change shared passwords the leaver could see.

At the end of week two, and again a month later, check that it stuck:

• Every staff member has accepted the invite and has MFA on
• Each person's vault has more than a handful of items
• Shared vaults contain the logins from the old spreadsheet
• The spreadsheet and any copies are deleted
• The admin report shows few weak or reused passwords, and the list is shrinking

Do it yourself or get help?

A small team with a confident office manager can run this plan alone. Get help if you have no one with time for two weeks, if shared logins are scattered across people's heads, or if you want Microsoft or Google sign-in set up.

Our Password Manager Rollout (S$290) sets up Bitwarden or 1Password in your name, builds the shared vaults, invites and onboards up to 10 users, moves passwords from your spreadsheet, and leaves a leaver checklist and a short staff guide.