BobWork VaultWhy do employees ignore the password manager you bought?
Employees ignore a password manager when it is harder than the habit it is meant to replace. If the shared login still lives in a spreadsheet, a chat thread or someone's memory, that is where people will keep looking.
A password manager for employees is a tool that stores each work login encrypted, fills it into the sign-in page, and lets an owner share specific logins with specific people. It is not a policy document. The rollout fails or succeeds on three practical things: the first logins you load, who can see what, and how quickly a new hire gets going.
Fixing those three is mostly an afternoon of admin, not a training programme. The rest of this guide walks through them in the order you would do them. The steps work for any tool, and a fuller product overview is on the password manager for employees page.
What should you move into the password manager first?
Move the shared logins that cause daily friction first, because people feel the benefit immediately. Starting with a long list of personal accounts makes the project feel like homework.
Use this order:
- Shared tools the whole team opens daily — the ad account, the invoicing tool, the design subscription, the CRM.
- Logins that currently travel by chat — anything people ask for in a group message. Our guide on sharing passwords without WhatsApp covers why those threads are a liability.
- Admin and billing accounts — domain registrar, hosting, payment providers. Few people need these, but losing access is expensive.
- Each person's own work logins — added gradually as staff sign in and save them.
You do not need to type anything by hand. Most managers import a CSV exported from your old tool or from Chrome. With BobWork Vault, the import page accepts exports from Chrome, Zoho Vault, 1Password, Bitwarden, LastPass or any CSV, and skips duplicates.
Before you import, delete dead accounts from the file. Moving junk over just makes search slower for everyone.
Which access levels should staff get?
Give each employee the lowest access level that still lets them do their job, and group logins into shared folders by team so you grant access once, not login by login.
Most tools offer some version of four levels. BobWork Vault names them Owner, Edit, View and Login only. Here is how to think about each, whatever product you use:
| Level | What the person can do | Good fit |
|---|---|---|
| Owner | Manage the item and who it is shared with | Team lead or the person who owns the account |
| Edit | See and change the login | Staff who maintain the account, e.g. update a password after a rotation |
| View | See the login details | Staff who sometimes need to read a value, such as a login URL or note |
| Login only | Sign in through the extension without seeing or copying the password | Interns, temps, contractors and anyone who just needs to get in |
Login only is the one to reach for more often than you think. A person who cannot see a password cannot paste it into a chat or write it on a sticky note. For outside help specifically, see login-only access for contractors.
Keep the number of Owners small. If everyone is an Owner, access sprawls and you lose the point of the exercise.
How do you run a 10-minute walkthrough for staff?
A 10-minute walkthrough is enough if it covers only the four things people do every day: sign in, save, fill and share. Skip everything else until someone asks.
Run it live on a screen share, with each person's account already invited, and ask them to follow along on their own machine.
- Minutes 0–2: Why this, why now. One sentence: shared logins move out of chat and spreadsheets into one place, and nobody has to remember or ask for them any more.
- Minutes 2–4: Create the master password. Explain it is the one password they must remember. Use a long passphrase. Mention that where a manager is zero-knowledge, a forgotten master password cannot be recovered by the vendor, so have them store the recovery option the tool offers.
- Minutes 4–6: Install and fill. Install the browser extension, open a work site, and use the fill icon or shortcut. Let everyone do it once.
- Minutes 6–8: Save a new login. Sign in to something new and accept the save prompt. Show the generated password option on a sign-up form.
- Minutes 8–10: Find what is shared with you. Show the shared folder for their team and what their access level means. Tell them where to ask for help.
End by asking each person to move one of their own logins before the day is over. A single completed action beats a slide deck.
What is the best password manager for employees?
The best password manager for employees is the one your staff will open every day, so judge it on how little effort it takes, not on the longest feature list. A tool nobody uses protects nothing.
Check these before you commit:
- Autofill that works on your real sites, including two-step sign-ins where the email and password are on separate pages.
- Sharing that matches how your team works — per login and by shared folder.
- Access levels that include a view-free option for temps and contractors.
- A leaver process that does more than delete an account.
- Honest limits. Check the vendor's plan page for mobile apps, single sign-on, policy enforcement and attachments if you need them, rather than assuming.
Cost matters for small teams, too. Our roundup of the best free password managers for teams compares what to look for before you pay for anything.
How do you answer common objections from staff?
Answer objections with a specific, truthful response and a small first step, not a lecture. Most pushback is reasonable and has a short answer.
| What staff say | A straight answer |
|---|---|
| "My browser already saves passwords." | A browser saver is tied to one profile and does not give you controlled sharing or a clean leaver process. See whether Chrome's password manager is safe for business. |
| "I'll forget the master password." | Use a long passphrase you can say aloud, and keep the recovery option your tool offers. With a zero-knowledge tool the vendor cannot reset it for you by default. |
| "Can the company see my personal stuff?" | Decide this before launch and tell people. Say which logins are work-only, and ask staff to keep personal accounts out. |
| "It slows me down." | Show the fill shortcut. Filling is usually faster than typing or finding a message. |
| "What if the vendor gets hacked?" | With zero-knowledge encryption the server holds only ciphertext. Zero-knowledge encryption explained shows what that means. |
Two habits help more than any argument. Leaders use the tool themselves, visibly. And the old method gets switched off, so the spreadsheet is archived and the chat thread is closed once the logins are moved.
What should you do about leavers and role changes?
When someone leaves, remove their access the same day and change the passwords for every account they could see. A password manager makes the first part easy, but the second part still needs a list.
For a leaver, work through this checklist:
- Remove their access to the password manager and hand over anything they owned.
- List every shared login they could open.
- Change the password on each of those sites, starting with the most sensitive.
- Check any 2FA codes tied to their phone and move them to a team-held method.
- Review the activity log for anything unexpected.
BobWork Vault has a guided offboarding flow that removes the leaver's access, hands over what they owned, re-keys the remaining shared items and builds a checklist of passwords to change on each site. It also keeps an audit log of actions. The full process, whichever tool you use, is in our employee offboarding password checklist.
Role changes deserve the same care. When someone moves teams, lower or remove their access to the old team's folders at the same time you grant the new ones.
How do you know the rollout is working?
The rollout is working when people stop asking each other for passwords. That is the real signal, and you can see it without any dashboard.
Look for these after the first two weeks:
- Requests for logins in group chats have stopped.
- New hires get their access on day one by invitation, not by a message from a colleague.
- The old spreadsheet has been archived, not just ignored.
- Shared accounts have a named owner.
If requests carry on, ask why. It is usually a missing login or the wrong access level, which is a quick fix. For a deeper setup guide, see how to set up a team password manager.
If you want a free option that includes team sharing, BobWork Vault is one. Create a free account, invite your team by email under Settings › Team › Invite teammate, and pick the access level for each person.
Try BobWork Vault — free for your whole team
BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.
Keep reading
- Employee offboarding checklist: what to revoke, rotate and hand over
- How to set up a password manager for a small team: a 10-step rollout plan
- How to share a password without revealing it to contractors, agencies and interns
- How to share passwords securely with your team (and stop pasting them into chat)
More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers
Questions
Do employees need a password manager at work?
Yes, if they handle shared or sensitive logins. A password manager replaces reused passwords, spreadsheets and chat messages with encrypted storage and controlled sharing, which also makes onboarding and leaving much cleaner.
How do I get staff to use a password manager?
Make it the easiest path. Move the shared logins staff use every day into it first, run a short walkthrough, and retire the old spreadsheet or chat thread so there is only one place to look.
Can employees share passwords without seeing them?
Yes, in tools that offer a login-only level. In BobWork Vault, Login only lets the browser extension fill the password while the teammate cannot see or copy it.
Is it safe for a company to store employee passwords in a password manager?
Generally yes, when it is zero-knowledge, meaning logins are encrypted in the browser and the server stores only ciphertext. Check the vendor's security page and use a strong, unique master password.
What happens to shared passwords when an employee leaves?
They should be treated as exposed. Remove the leaver's access, then change the password on each site they could open. BobWork Vault's offboarding flow builds that list of sites for you.