Business password managers: sharing and staff handovers

How do I choose a business password manager?

Use one common brief for your shortlist: the services involved, who must use them, who maintains each item and what happens when someone changes role or leaves. This guide uses current 1Password and Bitwarden documentation reviewed on 16 October 2026, plus a fictional access-planning exercise.

Explore the 1Password profile, Bitwarden profile and 1Password versus Bitwarden comparison for the two product starting points.

Know where the work items belong

A shared business login needs a continuing business owner even when the person who first saved it leaves. Record the service owner separately from the password-manager account that stores the item.

In 1Password, an Employee vault belongs to the team or business account and is intended for work items. Its items are not directly shared with colleagues, but authorised account recovery can allow access. It is different from a separate personal or family account; do not infer privacy or handover rules from a vault label alone.

Bitwarden’s collections guide describes organisation-owned shared items and access assigned to members or groups. Nested collection names do not automatically pass on a parent collection’s items or permissions. Map the actual ownership and access rather than treating the visual folder structure as an access policy.

Separate managing access from using a credential

The 1Password vault guide distinguishes managing a vault from the item permissions needed to view or change its contents. Teams and Business have different controls. A person’s direct assignment and group memberships both belong in the access review.

Bitwarden’s collection permissions combines organisation roles, collection settings and specific collection access. Its hidden-password options can still allow autofill and do not completely prevent access to the credential. A concealed field is not proof that the person cannot obtain the underlying secret.

Likewise, 1Password’s permission-enforcement explanation distinguishes cryptographic access from server and client controls. Restrictions such as hiding or preventing easy copying should not be treated as a way to withhold a secret from someone authorised to use it.

Write down the actual requirement: use an item, edit it, change its audience, export it or recover an account. Check each action in the proposed plan and configuration; avoid a single ambiguous “admin” column.

A four-item access plan for a small team

This fictional team has Alex and Jo in Operations, Mina in Finance and Eli on a temporary client project. Sam administers accounts. The table records intended business-user access to four labelled items; Sam’s effective administrative and recovery reach is a separate unresolved check. These are proposed audiences, not vendor-created groups or observed permissions.

There are eight intended item-to-person links before the departure and seven afterwards. That is four items and four named business users, not eight people or eight passwords. Sam is a fifth person whose broader access has not been determined by this map.

S03 is the only item whose proposed business audience changes. Alex remains its business owner and Jo remains an intended user. The plan does not prove that Eli has lost upstream access or forgotten a previously shared credential. Map these labels to the actual vaults, collections, direct grants and groups in an authorised evaluation.

Treat offboarding as several separate checks

The 1Password offboarding guide puts work-item transfer before account deletion, then covers suspension and changing shared passwords or tokens. Its Employee-vault deletion warning matters: removing the account before the necessary handover can destroy the items you intended to retain.

Bitwarden’s succession guide distinguishes organisation removal from an individual account under its basic workflow. It also notes that offline clients may briefly retain cached organisation data. Enterprise ownership, recovery and account policies can change the arrangement, so record the retained setup.

Removing an account does not erase information someone has already learned or copied. For the exercise, S03’s credential review remains pending. No service password is supplied, changed or reported as rotated. Keep completed actions separate from proposed ones.

Test recovery, browser use and phone access

Use fictional items in an authorised trial. Have the intended person find the right item, sign into a test service, identify its business owner and complete a normal handover. Repeat the relevant task in the browser and phone environments the team will retain.

Write recovery acceptance conditions before testing: who may initiate it, which email or identity dependencies apply, what happens to MFA and which work items remain accessible. Keep the vendor’s retained recovery configuration with the result; the fact that an administrator can invite people does not establish the recovery procedure.

Use two audience roles, including one that should not receive the item. Record the result, configuration and date. This article has not created an account, changed a permission, enrolled recovery, copied a vault or operated an employee departure. Its access arithmetic is an editorial planning example.

Check the business plan and complete cost

A free personal account, a sharing organisation and a business administration package can have different scopes. The reviewed Bitwarden plan guide allows a Free organisation for two users and up to two collections. An individual Premium subscription does not itself provide organisation sharing; a separate organisation arrangement is needed.

The five-person brief here therefore needs its own retained package, including Sam’s actual role and Eli’s external-access arrangement. Obtain a quote for the relevant controls rather than multiplying a personal-plan price by five. Confirm the vendor’s own definition of a billable member or guest.

Use the software subscription cost guide to keep supplier payments and staff time consistent. If the wider brief involves company sign-in and provisioning, use the identity and lifecycle checklist as a separate evaluation.

Keep a decision record, not just a feature list

The six-check worksheet covers ownership, effective access, daily use, recovery, departures and the commercial package. Actual results, evidence and decisions are blank. The download contains reference labels only; keep real passwords, tokens and recovery codes out of this planning document.

Choose the product and retained configuration that meet the written requirements. Give unresolved permissions, recovery or handover gaps an owner before rollout. Scores for convenience should not hide an unmet access requirement.

Frequently asked questions