Passwords and Shared Logins in a Small Office
Small teams share logins out of convenience and then lose track of who knows what. A password manager and a few house rules fix most of it.
In a small office, passwords drift. The supplier portal login is on a sticky note, the bank password is in one person's head, and the social media account is shared by everyone who ever worked there. None of this feels dangerous until someone leaves, or until one reused password leaks and opens several accounts at once.
Use a password manager
A password manager is software that stores and manages passwords for many services, usually protected by a single master password. For an office the important features are:
- Shared vaults or folders, so a login can be shared without sending it in a message.
- Per-person access, so you can remove a departing colleague in one step.
- A generator for long, unique passwords.
- Alerts when a saved password is weak or reused.
Pick one that the least technical person on the team can use without complaint. A tool nobody opens protects nothing.
One account per person where possible
Many services let you add team members, each with their own login. That is better than sharing one password: you can see who did what, and you can remove one person without changing everyone else's access. Keep truly shared logins for services that offer nothing else.
Turn on a second factor
Multi-factor authentication asks for two or more pieces of evidence before granting access, for example a password plus a code from an app. Turn it on first for email, banking, the password manager itself and anything that controls the domain or website. Email deserves particular care, because whoever controls the inbox can usually reset every other password.
Recovery codes and the second phone
When you enable a second factor, the service usually offers recovery codes. Store them in the password manager or in a sealed envelope with your office records. If the only phone with the authenticator app is lost, those codes are the way back in.
When someone leaves
- Remove them from the password manager and from every service that has individual accounts.
- Change any shared passwords they knew.
- Check that recovery email addresses and phone numbers on important accounts do not belong to them.
- Write the date and what was changed in your account register.
House rules worth writing down
- No passwords in email or chat messages.
- No reusing a work password anywhere else.
- Anyone who suspects a password has leaked says so at once, without blame.
Filed by Harriet Lowell · revised 2026-11-09