Choosing a Password Manager for a Small Business

Why shared spreadsheets and WhatsApp messages are a risk

Most small businesses start the same way: a spreadsheet called "passwords", a pinned WhatsApp message with the bank login, and the same password reused on five sites. The problems:

• Anyone who sees the file or chat has every login, including staff who left long ago.
• Reused passwords spread a breach. When one website leaks passwords, criminals try the same email and password everywhere else.
• You can't tell who used what, so after an incident you don't know what was exposed.
• Leavers keep access unless someone remembers to change every shared password.

CSA's guidance to use strong passwords and enable 2FA recommends long passwords of at least 12 characters and a different password for each account. Nobody can remember dozens of those. A password manager makes it realistic.

Bitwarden vs 1Password: prices and plans (approximate, October 2026)

From each vendor's own business pricing page, billed yearly, in US dollars. Check the page on the day you buy; prices can change and may be shown in your local currency.

Sources: Bitwarden business pricing and 1Password business pricing. Both offer free trials. Both store your vault encrypted so that the vendor cannot read your passwords.

Features that matter for a small team

• Shared vaults or collections by team (for example Admin, Marketing, Finance), so people see only what they need.
• Admin account recovery, so a forgotten master password doesn't lose a staff member's work logins.
• One-click removal of a leaver's access to every shared login.
• MFA for the password manager itself, ideally with an authenticator app or a security key.
• Single sign-on (SSO) with Microsoft or Google, if you want staff to use their work account to log in. Check which plan includes it.
• Passkey support, so staff can save passkeys as well as passwords.
• Reports showing weak, reused or exposed passwords.
• Apps for every device your team uses: Windows, Mac, iPhone, Android and the main browsers.

What about the password manager in my browser?

The password managers built into Chrome, Edge and Safari are far better than reusing passwords, and fine for personal use. For a business they have gaps: sharing with colleagues is limited, there is no central admin to remove a leaver's access, and work passwords end up mixed with personal ones on a personal profile.

A practical approach: use a business password manager for every work login, and turn off password saving in the browser on company devices, so passwords live in one place.

A one-week rollout plan

1. Day 1: Create the business account in your company's name, with two admins. Turn on MFA for both.
2. Day 2: Set up shared vaults or collections by team, and decide who can see each one.
3. Day 3: Move the shared logins from your spreadsheet into the right vaults. Then delete the spreadsheet and any chat messages containing passwords.
4. Day 4: Invite staff, with a short guide: install the app and browser extension, set a long master passphrase, turn on MFA.
5. Day 5: Change the most important shared passwords (bank, domain registrar, email admin, social media) to new random ones, now that only the vault holds them.
6. Following weeks: Each person moves their own work logins in and replaces reused passwords as they go.
7. Write a leaver checklist: remove the person from the password manager, and change any shared password they could see.

The master password is the one password people must remember. Suggest a passphrase of several random words, and never reuse it anywhere else.

Password managers and the PDPA

The PDPA requires businesses to make reasonable security arrangements to protect the personal data they hold. Many systems with customer data, such as your booking tool, CRM, email and accounting software, are protected only by passwords. Unique passwords, MFA and removing leavers' access promptly are part of showing you took reasonable steps. Our PDPA checklist for small businesses covers the rest.

One more use: store each account's backup codes in the password manager, so a lost phone doesn't lock you out. See our guide to setting up MFA for business accounts.

Do it yourself or get help?

A team of two or three can set up Bitwarden or 1Password themselves in an afternoon using the plan above.

If you would rather hand it over, a Password Manager Rollout (S$290) sets up Bitwarden or 1Password in your name with shared vaults by team, onboards up to 10 users, signs in with your Microsoft or Google account where supported, moves your old shared passwords in through a secure link, and gives you a one-click leaver checklist. You pay the vendor's licence fees directly.