The website password sits in a message, the agency holds the domain account and a former colleague created the main email account. A password manager can reduce dependence on memory and old conversations. For a team, choosing an application is only the beginning. What matters is separating identities, controlling who sees each secret and recovering access when somebody is unavailable.
Start with accounts that keep the business running
Inventory primary email, domain registration, hosting, website administration and payment services. Record the owner and recovery address without copying passwords into the table. Prioritise accounts that can reset others. An unprotected recovery email can undermine an excellent website password. Keep the inventory available to authorised people even when the website is down.
Give people separate identities
Where a service supports users and roles, create an account for each person. Do not use the owner’s account for all team activity. A password manager can distribute access to a common secret when an application has no alternative, but it does not replace individual roles or activity records. Check the chosen plan’s team, recovery and revocation features before moving every credential.
Use unique passwords and protect the vault
Let the manager generate long, random passwords for separate accounts. Do not reuse the vault password elsewhere. Enable available additional authentication and keep recovery methods in a protected place separate from your only working device. If services support passkeys or security keys, evaluate them alongside the team’s recovery requirements.
Divide access by responsibility
Someone writing articles does not necessarily need the payment processor account. Organise vaults or collections by responsibility and review membership regularly. Avoid public or non-expiring links when sharing secrets. Hiding a password on screen does not necessarily prevent an authorised person from using or extracting it through another method. Do not treat visual concealment as a guarantee against copying.
Prepare for departures and emergencies
When someone leaves, revoke access to both the vault and the underlying services. Rotate shared secrets they knew and review sessions, API keys and recovery methods. Establish who can restore access if an administrator is unavailable using the product’s supported mechanisms. Test the process without exposing real passwords. Recovery that exists only in one person’s memory remains fragile.
Sources and further reading
A CloudCity editorial guide informed by the documentation below. Check the official source for rules and procedures that may change.
