Password Managers and Passkeys for Small Teams

Published October 23, 2026 · Last reviewed October 23, 2026

What good password policy looks like now

NIST’s authentication guidelines (SP 800-63B) say that composition rules, such as requiring a symbol and a capital letter, push people toward predictable patterns, and instead advise checking new passwords against a blocklist of known-breached and common passwords. They also no longer recommend forcing routine password changes without a reason. In practice that means: favour length, block known-bad passwords, require a change only after a suspected compromise, and never rely on the password alone for anything important.

The Canadian Centre for Cyber Security and CISA both recommend password managers as the practical way to meet this; the Canadian Centre’s ITSAP.30.025 sets out what to look for.

Choosing a password manager: criteria, not brands

• Business plan with an administrator console: you can see who has an account, enforce MFA on the vault and remove access.
• Shared vaults or collections with per-person permissions, so shared logins stop travelling in chat and spreadsheets.
• Passkey support and a report of reused, weak and breached passwords.
• A documented recovery and emergency-access process, and clear information on how the vendor protects your data.
• Works on the devices staff actually use, including phones.

Rollout in four steps

Action

Start with the owner, administrators and finance. Install the manager, protect the vault with a long passphrase and MFA, and move the most valuable logins in first: email administrator, bank, payroll, registrar, accounting and the backup console.

Why it helps

The highest-value logins deliver the largest risk reduction and show staff how it works before the wider rollout.

Verification

Check the manager’s admin report: every pilot user shows MFA enabled and the high-value items stored.

Fallback if delayed

Where a business plan is not affordable yet, require a managed browser profile with a built-in manager and a screen-lock policy.

Action

Replace shared passwords with shared vault entries or delegated access. Where a service allows individual accounts or delegation (shared mailboxes are a common case), use them; otherwise store the shared login in a shared vault with named members.

Why it helps

A password known to six people cannot be revoked from one of them, and cannot be traced to the person who used it.

Verification

List your shared logins and show, for each, who has access and how a leaver is removed.

Fallback if delayed

Change the shared password whenever someone with knowledge of it leaves, and record the date.

Action

Switch on passkeys where available. In Microsoft 365 and Google Workspace, enable passkey or security-key sign-in for users, starting with administrators, and let staff enrol on the phone or laptop they use every day.

Why it helps

A passkey cannot be typed into a fake website, so it removes the most common way passwords are stolen.

Verification

Check the registered methods report in your identity provider, and sign in once as a test user with the passkey only.

Fallback if delayed

Keep the password and MFA path available while people learn, then remove it for the groups that have moved.

Action

Run the cleanup report and set a recovery plan. Use the manager’s reused, weak and breached password report to fix the worst first. Set up the vendor’s emergency-access or account-recovery option so the business can open an employee’s vault if they are unavailable.

Why it helps

Migrating passwords without fixing the weakest ones just copies the problem, and a vault nobody can open is its own outage.

Verification

Re-run the report in a month. The count of reused and breached entries should be falling, and a test recovery has been completed.

Fallback if delayed

Print a sealed recovery sheet for the owner’s vault and store it in the safe.

Common failure mode

Teams adopt a password manager but weaken it at the vault: a short master password, no MFA, or a single shared account for everyone. The second pattern is half-finished adoption, where the manager exists but critical passwords still live in a spreadsheet, a chat channel or the browser of an unmanaged personal device. Measure adoption from the admin report, not from the number of licences bought.

How it works

A password manager stores each credential encrypted under a key derived from something only the user knows, usually a master passphrase plus a device secret or MFA. It then fills the right credential only on the matching site, which also gives some protection from look-alike addresses. Business versions add an administrator layer to share items and remove people.

A passkey replaces the shared secret with a key pair. The service holds the public half; the private half stays on your device and signs a challenge that includes the site’s real address. Nothing reusable travels across the network, so there is nothing to steal from a fake page or a breached database. Many managers can store and sync passkeys, which makes recovery and device changes easier.

Worked example

This is a hypothetical example with invented figures. A 45-person engineering consultancy keeps shared logins in a spreadsheet on the file server. The IT lead sets up a business password manager, moves the shared logins into vaults for the three teams that need them, and enables MFA on every vault user.

The first cleanup report lists a number of reused passwords. The lead fixes the ones guarding email, the bank and the domain registrar first. Passkeys are enabled for the two administrators, and the spreadsheet is deleted from the server after a final check that nothing was missed.