If you are trying to choose a password manager for a company of 30 or 40 people, the decision comes down to 4 questions, and the monthly price is not one of them. What matters is what happens when somebody leaves, what happens when the owner is on a plane and the bookkeeper needs the bank login, what happens if the company selling you the vault gets broken into, and whether your team will actually use the thing after week 3. Answer those 4 honestly and the tool will earn what you pay for it, because it removes work that somebody in your company is doing badly today.
This article is written for the person who signs the check, not for whoever administers the system. There are no settings to configure below, only decisions to make and questions to bring to your IT provider.
What a password manager does for a company with no IT department
A password manager is a shared, locked list of every login your business uses, with one master key per person. Instead of 40 passwords living in 40 heads, in a spreadsheet and in a few browsers, they live in one place that logs who opened what and when.
The practical effect is that access becomes something the company owns rather than something individual employees carry around. That is the whole point, and it is why the choice is a business decision rather than a technical one. When your bookkeeper resigns on a Friday, the difference between a company that owns its access and a company that does not is measured in hours of scrambling and, occasionally, in a locked account nobody can recover.
The list of passwords your browser saved is the one most companies already run on
Most small companies already have a password system. It is the list of passwords the browser saved for everyone, and it was never designed to be one.
That list is a known target. Flashpoint, a threat intelligence firm that tracks stolen data, reported that malware built to harvest saved logins collected 1.7 billion credentials in the first 6 months of 2026, from 7.4 million compromised computers. The software that does this is ordinary malware. Somebody downloads what they think is a free utility, and within minutes everything the browser had remembered has been copied and is on its way to a market where it gets sold in bulk.
Read that number honestly before you act on it. Those 7.4 million machines are home computers as well as work computers, and most of them belong to people who have nothing to do with your business. What transfers to you is not the scale, it is the mechanism. One employee, one bad download, and the saved list on that laptop is gone in a single pass. If your payroll login and your bank login were in that list, they left with it.
A dedicated password manager will not make anyone immune to that malware, so nobody should sell it to you that way. It changes 2 things that matter afterwards: the vault stays locked without the master key, and you can see exactly which accounts were in it, so you change those rather than guessing at a list.
Ask your IT provider: if one of our laptops picked up that kind of malware tomorrow, which passwords would leave with it, and how would we find out?
The day somebody leaves is when you find out what you bought
Offboarding is the test that separates a serious password manager from a cheap one, so look at it before you look at anything else.
When an employee leaves a company that uses shared accounts and remembered browser logins, somebody has to sit down and think of every service that person could still reach. That list is never complete, because nobody wrote it down while the person was working there. A former employee is still on the shipping account 6 months later, not because anyone was careless, but because nobody had a list.
A password manager built for business gives you that list by default. You remove the person, you see every shared item they had access to, and you change those and only those. The features that make this possible are shared folders per team, per-item access, and an administrator view that shows who holds what.
Ask your IT provider: on the day somebody resigns, can you show me the full list of what they had access to, and how long does it take to change them all?
What happens if the company selling you the vault gets broken into
Assume it will happen, and choose accordingly. Every serious provider in this market has either had an incident or will have one, and the honest ones publish what happened.
What you are checking is whether the design protects you when the provider fails. There are 2 things to check. First, the provider must not be able to read your contents even if they wanted to, which they describe as not holding your master key. Second, the provider must publish an independent audit of that claim rather than simply asserting it on a marketing page. Ask to see the most recent one. If the answer is a brochure, keep looking.
A third signal is worth reading, which is what the provider did the last time something went wrong. A company that published a detailed account of an incident within days is telling you something useful about how the next one will go. A company with no public history at all is not necessarily safer, it may simply be smaller.
Ask your IT provider: if this vendor is breached, what exactly would an attacker have, and where is the independent audit that backs that answer up?
What it costs, and what it is supposed to replace
Business plans for the main password managers sit in the range of a few dollars per user per month, which for a 40-person company lands somewhere between $1,000 and $2,000 a year. That is a small number next to almost anything else on your technology bill, so cost is rarely the deciding factor.
The number worth calculating is what it replaces. If the tool removes the shared spreadsheet, the sticky notes, the 4 people who all know the bank password, and the 2 hours somebody spends resetting accounts every time a laptop is replaced, it has paid for itself in the first quarter. If it sits unused next to all of those because nobody was trained on it, you have bought a subscription and kept the risk.
That is why adoption belongs in the buying decision. The version your team will actually open is worth more than the version with the better feature list. Ask for a 2 week trial with 5 people who are not technical, and watch whether they still use it in week 3.
What to ask before you sign anything
Bring these to whoever handles your technology, and expect the answers in writing.
- Which accounts in this company do more than one person use today, and who exactly are those people?
- If our bookkeeper left tomorrow, what would still be reachable by them a week later?
- Does this vendor hold anything that would let them read our contents, and where is the independent audit that says so?
- What happens if the owner loses the master key, and who else in the company can recover an account?
- What is the plan to get the team using it, and who is responsible for checking in 90 days that they still are?
If the answers to questions 1 and 2 take more than a day to produce, that delay is the finding. It means nobody currently has a list of who can reach what inside your business, and building that list is the real project. The password manager is simply where the list gets kept once it exists.
Choosing well is less about comparing feature tables and more about deciding that access to your company is something the company owns. Everything above follows from that.
