BobWork VaultWhat is a team password manager?
A team password manager is a shared, encrypted vault where a business stores the logins its people use, and controls who can use each one.
A personal password manager solves one person's problem: remembering many strong, unique passwords. A team password manager solves an organisation's problem: many people need some of the same logins, people join and leave, and someone has to know who had access to what.
Both encrypt passwords and fill them into login forms. The difference is everything around the vault: sharing, permissions, ownership, offboarding and a record of activity.
What does a team password manager do that a personal one doesn't?
A team password manager adds four things a personal one doesn't have: shared folders, access levels, an offboarding process and an audit log.
| Capability | Personal password manager | Team password manager |
|---|---|---|
| Sharing | Usually one-off shares with family or a friend | Shared folders per team, client or project |
| Permissions | The owner sees everything | Access levels per person, per item or folder |
| Ownership | Belongs to one person | Belongs to the organisation, managed by admins |
| People leaving | Not a concept | Remove access, hand over items, list passwords to change |
| Accountability | No need for it | Audit log of who did what |
Some personal products offer family or business plans that add parts of this. When comparing, look at what the specific plan includes rather than the product name.
How do shared folders work in team password management?
Shared folders let you grant access to a group of logins at once instead of sharing passwords one by one.
Good team password management starts with a folder structure that mirrors how work is organised. Common patterns:
- By team: Marketing, Finance, Engineering, Operations.
- By client: one folder per client account, which suits agencies and freelancers.
- By sensitivity: a small "Admin" folder for banking, the domain registrar and cloud root accounts, kept to two or three people.
When someone joins a team, you add them to that team's folder and they get every login they need on day one. When they move teams, you change folder membership instead of hunting through individual shares.
Keep personal logins out of shared folders. A team vault works best when every item in a shared folder is genuinely a company account.
Which access levels should a team password manager offer?
A team password manager should let you choose, per person, whether they can manage, edit, view or only use a login.
The levels most teams need look like this:
| Access level | What the person can do | When to use it |
|---|---|---|
| Owner | Edit, share, change access, delete | The person accountable for the account |
| Edit | Update the password and details | Teammates who rotate or maintain the login |
| View | See and copy the password | Trusted staff who sign in on other devices |
| Use only (fill without revealing) | Sign in through the browser extension, can't see or copy the password | Contractors, interns, temporary help |
The last level matters most. If a person never sees a password, they can't paste it into a chat, save it in a personal browser or keep it after they leave. It applies the principle of least privilege, which guidance from CISA and OWASP consistently recommends. There is more on that pattern in giving contractors login-only access.
What should happen to passwords when someone leaves?
When someone leaves, their access should be removed the same day and every shared password they could see should be changed.
Removing the person from the password manager is the easy half. The harder half is that they may still remember, or have saved, passwords they viewed. A team password manager helps with both halves:
- Remove the person's access to every item and folder.
- Move ownership of anything they owned to a named successor.
- Produce a list of the logins they could see, so you know which passwords to change.
- Change those passwords on each site, starting with email, banking and admin accounts.
- Move any two-factor authentication that was tied to their phone or email.
Logins they only used through fill-without-revealing access are lower priority, because they never saw the password. For a fuller day-by-day list, see the employee offboarding password checklist.
Why does a team password manager need an audit log?
An audit log records actions in the vault, so you can answer "who changed this, and when?" without guessing.
In practice the log is used for three things. First, troubleshooting: a login stopped working and you want to know who updated it. Second, offboarding: confirming what a leaver had access to. Third, reviews: a client, insurer or auditor asks how you control access to shared accounts.
You won't read the audit log every day. You'll be glad it exists the first time something goes wrong.
How should a team handle two-factor codes on shared accounts?
Shared accounts with two-factor authentication need a plan for who receives the code, or the whole team depends on one person's phone.
Look for a tool that can store authenticator (TOTP) secrets alongside the login, or at least record who holds the 2FA for each account. Keep backup or recovery codes for each shared account where the right people can reach them. Without that, a holiday or a resignation can lock everyone out.
Team password manager buyer checklist: what should you check?
The right team password manager is the one that covers your sharing, permissions and offboarding needs on the devices your team actually uses.
Use this checklist when comparing tools:
- Encryption model. Is it zero-knowledge, with data encrypted on your device before it reaches the server? See zero-knowledge encryption explained.
- Shared folders. Can you share a whole folder, not just single items?
- Access levels. Is there a level that lets someone sign in without seeing the password?
- Offboarding. Is there a guided way to remove a person, hand over their items and list passwords to change?
- Audit log. Are actions recorded, and can admins see them?
- Devices and browsers. Does it work on the browsers and phones your team uses? Check this early.
- Two-factor handling. Can it store TOTP secrets or record who holds each account's 2FA?
- Import. Can you import a CSV from your browser or current tool?
- Account recovery. What happens if someone forgets their master password, and who can help?
- Identity integration. If you rely on SSO or SCIM provisioning, confirm the plan includes it.
- Cost per seat. Check each vendor's plan page for what the free tier includes and how pricing scales with headcount.
Run a short trial with two or three real users and one real shared folder. Problems with autofill or permissions tend to show up quickly in daily use.
Where does BobWork Vault fit as a team password manager?
BobWork Vault is a free team password manager by BobWork, and team sharing is included on the free plan.
It covers the team features above: shared folders; per-person access levels (Owner, Edit, View and Login only, where the extension fills the login but the teammate can't see or copy it); a guided offboarding flow that removes a leaver's access, hands over what they owned, re-keys remaining shared items and builds a checklist of passwords to change; and an audit log of actions. Everything is encrypted in the browser with AES-256-GCM, and the server stores ciphertext only. It can also store authenticator secrets and show which logins depend on one person's 2FA.
The limits are worth knowing: it runs as a Chrome extension (also Edge, Brave and Arc) plus a web vault that works in any modern browser, with no mobile apps, no SSO/SCIM and no file attachments. If that fits your team, the team password manager setup guide walks through the first steps, or you can create a free vault.
Try BobWork Vault — free for your whole team
BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.
Keep reading
- How to set up a password manager for a small team: a 10-step rollout plan
- Employee offboarding checklist: what to revoke, rotate and hand over
- How to share a password without revealing it to contractors, agencies and interns
More: free password manager · free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers
Questions
Can I use a personal password manager for my team?
You can, but you lose shared folders, access levels, offboarding and an audit log. Sharing one personal account between colleagues also means everyone sees everything, and nobody can be removed cleanly.
Is team password management worth it for a small business?
Yes. Even a team of three shares logins, and the first time someone leaves you need to know which passwords they saw. A team password manager turns that into a list instead of a guess.
Is it safe to store shared passwords in a team password manager?
Yes, if it uses zero-knowledge encryption, meaning passwords are encrypted on your device and the provider stores only ciphertext. That is far safer than spreadsheets, chat messages or a shared browser profile.
What happens if the admin of a team password manager leaves?
Ownership of their items should move to another admin before they go. Keep at least two people with admin rights so the organisation never depends on one person.
Can contractors use a login without seeing the password?
Yes, in tools that offer a fill-without-revealing access level. The extension signs them in, but they can't view or copy the password, so there is less to change when the work ends.