writings · 13 Apr 2026
your passwords are a business risk
// security · small business · practical guide
I help businesses with their IT. Not just the interesting problems — all of it. The infrastructure, the tooling, the workflows, the things that quietly create risk long before anyone notices. Password management comes up in almost every engagement I have with a small business, and the situation is almost always the same: credentials live in someone's head, in a spreadsheet, or scattered across browser profiles on laptops the business doesn't control. Nobody thinks of it as a risk until something goes wrong.
I care about this enough to write it down for anyone who wants to get it right.
the three problems
There are three failure modes I see consistently, and they compound each other.
No password manager. Credentials live wherever they landed — browser autofill, a notes app, a spreadsheet titled "passwords DO NOT SHARE" that has been shared with everyone. There is no record of what accounts exist, who has access to what, or what happens to that access when someone leaves.
No secure sharing. When a team needs to share a login, the password goes over Slack, WhatsApp, or email. Everyone who ever received that message now has that credential indefinitely, on a device the business has no visibility into. When someone leaves, you don't revoke their access — you hope they don't use it, then eventually change the password manually, then forget which other services were using the same password.
Weak or reused passwords. Most people know they shouldn't reuse passwords. Most people reuse passwords anyway, because generating and remembering a unique credential for every service is genuinely difficult without tooling. A single breach at one service becomes a breach at every service using the same password. At a business scale, that is a serious exposure.
Each problem is bad in isolation. Together, they mean a single disgruntled ex-employee or a single compromised account anywhere in your stack can cause real damage.
what a password manager actually does
A password manager is a secure, encrypted vault for credentials. It generates strong, unique passwords for every service — passwords you never need to remember or even see. It autofills them when you log in. It works across every device.
That is the basic function. What makes it genuinely useful for a business is what sits on top of that.
Secure sharing. Credentials can be shared with a team member without that person ever seeing the password. They get access; they can log in; they cannot copy the password out and take it with them.
Two-factor authentication. 1Password can store your 2FA codes alongside your credentials in the same vault. This is more significant than it sounds. When a shared service account has 2FA enabled, the traditional options are either to disable 2FA (removing the protection) or to route the code to one person's phone (creating a bottleneck). With 1Password, the 2FA code lives in the vault with the password. Whoever has vault access can authenticate fully — without you having to share the code separately or weaken your security posture to make it work.
Watchtower. 1Password monitors your credentials against known breach databases and flags passwords that are weak, reused, or compromised. It is not passive storage — it is ongoing risk monitoring.
why a business account specifically
A personal 1Password account solves your own credential problem. A business account solves the team problem — and the team problem is a fundamentally different shape.
The key concept is the vault. A vault is a collection of credentials. Vaults belong to the business, not to any individual. Users are assigned to groups, and groups are given access to vaults. When someone joins, you add them to the right groups and they immediately have access to everything they need. When someone leaves, you remove them from the platform and their access to every vault is revoked simultaneously — the credentials stay, the person does not.
My recommendation is to be granular with vaults. There is no cost to having more of them. A sensible starting structure for most small businesses:
- A personal vault for each team member — private, not shared
- A shared business vault for day-to-day team credentials
- A finance vault for banking, payroll, and accounting access — restricted to the people who need it
- An IT vault for infrastructure credentials, hosting, DNS, registrars — shared with your IT provider as a guest, revoked cleanly when the relationship ends
That last one matters. Sharing an IT vault with an external provider is clean, auditable, and reversible. Sending passwords over email is none of those things.
the plans
For most small businesses, there are two options worth knowing about.
Teams Starter Pack at $19.95/month covers up to 10 users. Flat rate, no per-seat complexity. The right starting point for a small team that wants shared vaults and proper access control without worrying about the bill as the team grows.
Business at $7.99/user/month is the step up — it adds custom roles, advanced policies, and event reporting. It also includes a free Families plan for every user on the account. For a solo founder or a very small team, that last point reframes the price entirely: for roughly $8/month you get business credential management and personal password management for your household. The value equation is different from what it looks like on paper.
If you are under 10 people and not yet dealing with compliance requirements, start on Teams Starter. Upgrade when governance becomes a real need.
the setup
1. Create a business account
Go to 1password.com and start a free 14-day trial — no credit card required. Choose Teams Starter or Business depending on your situation. The trial gives you full access to both plans, so you can evaluate before committing.
2. Set up your vaults
Before inviting anyone, set up your vault structure. The default is a single shared vault — replace this with a deliberate structure from the start. Create your shared business vault, your finance vault, and your IT vault. You can always add more later; it is much harder to reorganise after credentials are already scattered.
3. Create your groups
Groups are how you assign vault access at scale. Create groups that reflect how your team is actually structured — an all-staff group for the shared business vault, a finance group for the finance vault, an it-admin group for the IT vault. Assign vaults to groups, not to individuals, so that adding someone to a group is all it takes to give them the right access.
4. Invite your team
Invite team members by email from the admin console. Assign them to the appropriate groups on the way in. New employees arrive with access to everything they need on day one.
5. Install the apps
Every team member should install the 1Password desktop app for their operating system and the browser extension for their browser of choice. This is where the autofill experience lives — credentials available everywhere, without friction. The mobile app is worth having too.
6. Import existing passwords
Every major browser can export saved passwords as a CSV. Chrome, Safari, Firefox, Edge — they all have the option buried somewhere in settings. Import that CSV into 1Password and move the credentials into the appropriate vaults. This is the moment of transition: existing credentials move into the managed system, the browser's built-in password storage gets cleared, and everything is in one place.
7. Enable 2FA on your 1Password account
Before anything else is in the vault, secure the vault itself. Enable two-factor authentication on your 1Password account. This is the master key — treat it accordingly.
a note on passwords going forward
Once 1Password is in place, the discipline is simple: every new account gets a password generated by 1Password — random, unique, never reused. The generator is built into the browser extension and appears whenever you create a new login. You never need to think of a password again. You also never need to remember one.
The length and character set are configurable. I use 20-character random strings for most things and passphrases for anything I might occasionally need to type manually.
This is not a complicated setup. The whole thing can be done in an afternoon. The return — clean offboarding, no credential sprawl, 2FA that actually works for shared accounts, a clear picture of who has access to what — is disproportionate to the effort.
I help my clients with all of this as part of how I work with them on their IT. I care about it enough to write it here for anyone who wants to do it themselves.
// questions or corrections — [email protected]