A password manager for your team, not a shared spreadsheet

Sharing credentials is a real business need: the question is the container, because a password outlives the conversation it was sent in.

Somewhere in most companies sits a shared spreadsheet of passwords, or a notebook, or a chat message with logins pasted in at midnight. It exists because the need underneath it is real: the domain panel, the social accounts, the hosting, the analytics, each one belonging to the company and needed by more than one person. Nobody in that company was careless. The container simply grew by accident, and that is the part worth examining.

The honest framing is that sharing credentials is a legitimate business requirement, and the question was never whether to share. The question is the container, because the container decides what survives. A group chat keeps the password after the sender leaves, and after the account changes, and after the company forgets the password was ever sent. A spreadsheet copies itself into every download, every personal laptop, every backup nobody indexed. The container is the security, whatever the contents.

The failure versions write themselves from real patterns. The password that stays searchable in the group chat years after the person who sent it has gone, still valid, still working. The ex-staff member who still knows everything, not through anyone's bad intent, but because rotation was never anybody's job. The one password leaked somewhere unrelated and reused across the whole list, where a breach at another company becomes a breach of every account the team owns in the same afternoon.

The practice replaces the accident with an arrangement. One encrypted vault holds the credentials, and each person enters with their own identity, because a shared login pretending two people are one cannot be revoked from one of them. Access is granted by role rather than shouted across the room: whoever needs the domain panel this month sees the domain panel. And rotation becomes a step in off-boarding, standing in the same line as the laptop and the mailbox, so a departure has an end.

This pairs naturally with the blast-radius thinking from the second-factor discipline: protect in order of damage, registrar and email first, and let the rest follow. A vault makes that order easier to keep, because every login has one recorded home, one owner, one place to check whether the second factor is actually switched on. The product matters less than the arrangement; almost any vault beats the spreadsheet, and the discipline is what the spreadsheet never had.

We run our own credentials this way, and when we take over a client's accounts, moving them into an arrangement like this is part of the handover, because credentials scattered across chats are a liability we would otherwise inherit. Guidance, not guarantees: the vault holds the keys, and the discipline decides whether the keys are safe; the specifics of your accounts belong in your own inventory, kept by name.