Stop keeping passwords in a spreadsheet
Shared logins live in a spreadsheet or a chat message, get reused across services, and nobody removes access when someone leaves.
Tools worth considering
Google Workspace
Business email on your own domain plus documents, storage, video meetings and calendars, with Gemini AI included across the plans.
No free plan; 14-day trial. Business Starter EUR 6.80 per user/mo with 30 GB pooled storage per person; Business Standard EUR 13.60 with 2 TB; Business Plus EUR 21.10 with 5 TB; Enterprise custom. Prices shown are on annual billing, which saves 16%
1Password
Password manager with shared vaults, breach alerts and identity provider integration, so team credentials stop living in messages and spreadsheets.
No free plan; 14-day free trial on all plans. Individual $2.99/mo paid annually ($3.99 monthly); Families $4.49/mo paid annually ($5.99 monthly); Teams Starter Pack $24.95 for 10 members paid annually; Business $8.99 per user/mo paid annually
The problem
Almost every small business has the file. A spreadsheet, a note, or a pinned message with the logins for the bank portal, the social accounts, the domain registrar and the invoicing tool. Everyone who needs one has seen all of them.
Three things follow. Passwords get reused, because inventing and remembering distinct ones without a system is impossible, so one leaked service exposes several. Access never gets revoked, because removing a person means changing every shared password and telling everyone the new one, which nobody does. And the highest-value accounts, the domain and the bank, sit in the same file as the least important.
The specific event this ends with is ordinary: a former contractor still has the social login, or a phishing email catches one person and the reused password opens three more doors.
What AI can actually do here
Nothing, and that is the point. This is not an AI problem and buying an AI product to solve it would be a mistake.
What a password manager does is mechanical and boring: generate a distinct strong password per service so a single breach stays contained, store them encrypted so the file is not readable by whoever finds it, and share specific items with specific people so access can be removed one person at a time.
Two mechanisms matter more than the rest for a business. Vault separation means the domain registrar and the bank are not in the same place as the newsletter tool, so not everyone with a login has everything. And two-factor authentication on the accounts that matter is worth more than any password policy, because it survives the password being stolen.
The honest ranking: distinct passwords, then two-factor on the critical accounts, then the tooling that makes both survivable.
How the tools differ
1Password is the dedicated manager. No free plan, 14-day trial on all plans. Individual is $2.99 per month paid annually or $3.99 monthly, Families $4.49 annually, the Teams Starter Pack $24.95 for 10 members paid annually, and Business $8.99 per user per month paid annually. The Teams Starter Pack is the relevant number for a small business: ten people covered for less than a typical single-seat subscription.
Google Workspace is not a password manager, and it belongs here for a different reason. If your team logs into services with a company account, offboarding becomes one action rather than a hunt through a spreadsheet. No free plan, 14-day trial, Business Starter EUR 6.80 per user per month with 30 GB pooled per person, Standard EUR 13.60 with 2 TB, Business Plus EUR 21.10 with 5 TB, on annual billing which saves 16%.
The two work together rather than competing. Identity handles who exists, the manager handles the credentials that are not tied to identity.
When you don't need a tool
If you are one person, your browser or operating system password manager is genuinely adequate and free. The upgrade is worth it for sharing, not for storage.
If nobody will adopt it, do not buy it, but do fix the two accounts that would end the business if lost: the domain and the email. Two-factor on those two, today, is worth more than a rollout that stalls.
Get advice for your situation
Your AI consultant
Free · no signup · advice first
An example
Your turn
Or start with a question people ask about this:
By chatting you agree to our terms.
Frequently asked questions
Is a spreadsheet of passwords really that bad?
Yes, for two reasons that are independent of each other. It is readable by anyone who obtains the file, and it makes password reuse inevitable, which turns one breach into several. Even encrypting the file leaves the reuse problem untouched.
What should I do first?
Turn on two-factor authentication for your domain registrar and your primary email account. Those two are the recovery path for everything else, so losing them loses the rest. That takes about ten minutes and outweighs any password policy you could adopt.
How do I remove access when someone leaves?
With shared vaults, revoke their access to the vault and rotate the credentials that were in it. Without a manager you have to change every shared password individually, which is why it does not happen. Write the offboarding steps down before you need them.
Do I need this if we use company accounts for everything?
It helps, and it is not sufficient. Plenty of business services are not tied to your identity provider, and those are exactly the ones that end up in a spreadsheet. Use both: identity for what it covers, a manager for the rest.