How to set up a password manager for a small team: a 10-step rollout plan

Why does a rollout plan matter for a small team?

Installing a password manager takes minutes. Getting a team to actually stop using chat messages, spreadsheets and sticky notes takes a plan.

The ten steps below work with most team password managers. Where BobWork Vault has a specific screen, it is mentioned, but the plan stands on its own. If you have not chosen a tool yet, start with the buyer's guide.

Treat the steps as a checklist. Tick each one off, note who did it and when, and keep the list somewhere the backup admin can find it. When a new person joins later, steps 4 to 8 double as your onboarding routine.

Step 1: Who should own the rollout?

Pick one person as the owner. It does not need to be an IT specialist, just someone organised who will see it through.

• The owner creates the team account and holds the Owner role.
• Name a second admin as backup, so the team is never locked out if the owner is away.
• Set a target date, such as two weeks, for everyone to be using the vault.

The owner's first job is a quick inventory: list the shared accounts the team relies on, who uses each one, and where its password lives today. That list becomes your folder plan in Step 3 and your offboarding checklist in Step 9.

Step 2: How do you import existing passwords?

Gather passwords from where they live today: browsers, an old password manager, spreadsheets. Export each source to CSV and import it into the new vault the same day.

In BobWork Vault, the import page accepts CSV files from Chrome, Zoho Vault, 1Password, Bitwarden, LastPass or any CSV. The file is read and encrypted in the browser and duplicates are skipped. Delete the CSV and empty the trash afterwards.

Exact menu paths for each tool are in how to export passwords.

Step 3: How should you structure shared folders?

Organise by who needs access, not by type of website. A simple structure for a small team:

Personal work logins stay in each person's own vault. Only genuinely shared accounts go into shared folders.

Step 4: Which access levels should each person get?

Give people the least access that lets them do their job. Many tools offer several levels. In BobWork Vault they are:

• Owner: full control, including sharing and deleting.
• Edit: can view and update the login.
• View: can see and copy the login.
• Login only: the extension fills it in, but the person cannot see or copy the password.

Login only suits contractors, interns and part-timers. Fewer people knowing a password means fewer passwords to change when someone leaves.

Step 5: How do you invite the team?

Invite people by email and choose their access as you go. In BobWork Vault that is Settings › Team › Invite teammate, where you pick what each person gets.

• Send invites in a short window, ideally with a 15-minute group session.
• Help everyone install the browser extension. BobWork Vault's extension runs on Chrome, Edge, Brave and Arc; Firefox and Safari users use the web vault.
• Ask each person to choose a long, unique master password, ideally a passphrase of several random words.

Step 6: Why turn off Chrome's own autofill?

If the browser keeps offering to save passwords, people end up with logins in two places, and the old copy never gets updated. Two managers competing for the same field also confuses autofill.

Turn off the browser's built-in password saving on every work computer once the import is done. BobWork Vault offers an option to turn off Chrome's own autofill and password saving, so the two do not compete.

Step 7: How do you move 2FA codes into the vault?

Shared accounts often have two-factor authentication tied to one person's phone. That person becomes a bottleneck and a single point of failure.

1. In the site's security settings, add a new authenticator app.
2. Copy the setup key (the text version of the QR code) into the login's 2FA field in your vault.
3. Confirm with a code to complete the setup.

BobWork Vault stores authenticator (TOTP) secrets and fills or copies the 6-digit code after the password.

Step 8: What is your recovery plan?

With a zero-knowledge password manager, a forgotten master password can mean lost data. Plan for it before it happens.

• Have everyone save their Emergency Kit and store it somewhere safe offline.
• Decide whether to enable admin-assisted recovery. In BobWork Vault, nobody, including BobWork, can recover a master password by default; organisations can opt in to admin-assisted recovery, and members enrol.
• Make sure at least two admins can manage the team.

Step 9: What should your offboarding routine look like?

Write the routine down now, while nobody is leaving. A good checklist:

1. Remove the person's access to the vault on their last day.
2. Transfer anything they owned to a remaining teammate.
3. Change the passwords on the actual websites for everything they could see or copy.
4. Rotate any 2FA they managed and update recovery emails or phone numbers.

BobWork Vault has a guided offboarding flow that removes access, hands over owned items, re-keys remaining shared items and builds a checklist of passwords to change on each site, with actions recorded in the audit log.

Step 10: What should you review each month?

A 20-minute monthly review keeps the vault healthy:

• Check password health for breached, weak or reused passwords and fix a few each month.
• Review who has access to each shared folder and remove anything no longer needed.
• Look for logins still stored outside the vault, such as in chat history or documents.
• Check the audit log for anything unexpected.

For the habits side, see how to stop password reuse. If you want a free tool that covers all ten steps on desktop browsers, you can create a BobWork Vault team in a few minutes.

What are the most common rollout mistakes?

• Importing everything into one shared folder. Everyone sees everything, and offboarding becomes painful. Sort into team folders first.
• Skipping the browser autofill step. Old passwords linger in the browser and people keep using them.
• No backup admin. If the only owner leaves or forgets their master password, the team is stuck.
• Leaving 2FA on one phone. The shared account still depends on one person.
• Announcing without helping. A short group session where everyone installs the extension together works better than an email.
• Forgetting old copies. Search chat history, shared drives and notes apps for passwords and delete them once they are in the vault.

Each of these is easy to fix early and harder to fix once habits form.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• The best free password manager for teams in 2026: a fair buyer's guide
• How to export passwords from Zoho Vault, LastPass, 1Password, Bitwarden and Chrome
• How to get employees using unique passwords (and stop password reuse)
• How to share passwords with your team

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers