[{"data":1,"prerenderedAt":142},["ShallowReactive",2],{"publication:en:P172":3},{"meta":4,"copy":16,"relatedArticles":128,"terms":129,"term":130,"resourceParent":136,"glossaryParent":139},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15},"P172","\u002Fglossary\u002Fpassword-manager","term","what is a password manager","What is a password manager? Vaults, sharing and recovery","What is a password manager? Vaults and business access","Understand password managers, vault protection, sharing and recovery. Separate storing a credential from controlling access to the underlying business account.",[13,14],"\u002Fservices\u002Faccess-2fa-audit","\u002Fblog\u002Femployee-offboarding-access","2026-10-30",{"intro":17,"sections":18,"checklistTitle":87,"checklist":88,"faq":96,"sources":106,"links":109,"cta":123},"A password manager stores credentials in a protected vault and helps people create and use different passwords for different accounts. Business features may also support shared access, administration and recovery. The vault controls access to stored secrets; the underlying service still controls its own accounts, permissions, sessions and credential validity.",[19,28,64,69,77,82],{"title":20,"paragraphs":21,"sources":24},"Understand the vault and the account it unlocks",[22,23],"A saved item can contain a website address, username, password and other information. The manager may generate a password and offer it through an application or browser extension. Its value is reducing the need to remember or reuse passwords while keeping the approved credential available to the people who need it.","The NCSC UK buyers guide describes both the usefulness and concentration risk of password vaults. Protect the vault's sign-in and recovery as an important account in its own right. Do not treat a product's encryption label as evidence that every field, session, extension and recovery process has the same protection. Check the vendor's supported behavior for the actual product and plan.",[25],{"label":26,"url":27},"NCSC UK: password manager buyers guide","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002Fpasswords\u002Fpassword-manager-buyers-guide",{"title":29,"paragraphs":30,"sources":33,"table":37},"Choose ownership before deciding where to save work credentials",[31,32],"A personal vault and a company-managed vault can create different control and continuity arrangements. Ask who owns the subscription, who can invite people, which items are shared and what remains available when a person leaves. A business should be able to identify the owner of its critical hosting, domain and email credentials without requiring a former employee's personal account.","The NCSC NZ guidance treats selection, rollout and ongoing use as connected decisions. For your own deployment, map the workflow before importing secrets. A named account at the underlying service is often preferable to distributing one shared login where the service supports appropriate roles. The vault is useful for necessary secrets; it does not make unnecessary account sharing a better design.",[34],{"label":35,"url":36},"NCSC NZ: password manager selection and rollout","https:\u002F\u002Fwww.ncsc.govt.nz\u002Fprotect-your-organisation\u002Fpassword-managers\u002F",{"caption":38,"headers":39,"rows":43},"Password manager and business account controls",[40,41,42],"Layer","What to establish","What it does not establish",[44,48,52,56,60],[45,46,47],"Vault sign-in","Who can unlock the approved manager.","Which business systems their account can administer.",[49,50,51],"Shared collection","Which stored items the person can use.","That an already copied password can be retracted.",[53,54,55],"Underlying account","Who can sign in and perform approved work.","That every stored copy has been removed.",[57,58,59],"Recovery","Who can restore authorized vault access.","Guaranteed recovery under every loss scenario.",[61,62,63],"Exit","How ownership and usable records transfer.","Automatic revocation of passwords and sessions.",{"title":65,"paragraphs":66},"Review local storage, synchronization and supported sharing",[67,68],"Some managers store the vault locally; others synchronize through a service. Some are built into a browser or operating system, while others offer separate applications and business administration. Those labels do not establish the full security or suitability of a specific setup. Ask what works on the devices and browsers staff actually use and which recovery dependencies follow.","Controlled sharing can avoid sending credentials through ordinary chat or an unprotected spreadsheet. It still needs appropriate membership and item scope. Check whether access is read-only, whether secrets can be revealed or exported and how changes are logged under the chosen plan. Record a limitation rather than assuming a feature exists because another product uses similar terminology.",{"title":70,"paragraphs":71,"example":74},"Keep the recovery path available without making it a shortcut",[72,73],"A vault that nobody can unlock can interrupt many business systems at once. Identify supported recovery methods, required administrators, protected recovery material and any account or device dependency. Keep recovery information out of ordinary support tickets and decide who may authorize its use. A recovery request needs identity verification, not simply a message claiming urgency.","Distinguish a simulated discussion from a demonstrated recovery. Start with a synthetic vault and test identity before attempting any exercise involving real secrets. If a supported process cannot recover a forgotten vault password or lost key, document that outcome and the alternative account-reset plan. Do not invent a recovery promise based on an encrypted backup file alone.",{"title":75,"text":76},"Illustrative circular recovery route","The business stores its vault recovery instructions inside the same vault and relies on a mailbox whose password is also unavailable. The proposed exercise identifies the circular dependency; it has not demonstrated a working recovery path.",{"title":78,"paragraphs":79},"Treat copied passwords and departures as account changes",[80,81],"Removing someone from a shared collection limits future vault access under that configuration. It cannot erase a password the person already knew or copied. Decide whether the underlying secret must change, the account must be disabled or sessions must be reviewed. Coordinate changes with the legitimate integrations that depend on the same credential so a security action does not silently stop operations.","A password manager also does not automatically turn every login into MFA or make a site legitimate. Keep account authentication, staff awareness, application permissions and session controls as separate review items. An organization can improve password handling while still needing to repair an overprivileged account or investigate a suspicious login.",{"title":83,"paragraphs":84},"Evaluate usefulness through an ordinary working day",[85,86],"Use synthetic accounts to try the actual tasks: saving a new item, finding it on another approved device, sharing it with a colleague and removing the test member. Check the owner's understanding as well as the screen result. A tool that staff cannot use reliably may lead to credentials being copied back into unmanaged places.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with Israeli technical knowledge of website, account and digital-infrastructure security. We can scope the ownership review and supported setup around the systems you already use. Product selection needs current evidence and a pilot; this definition does not name a universally best manager or guarantee that a vault cannot be compromised.","What to establish about a password manager",[89,90,91,92,93,94,95],"Company and personal ownership distinguished","Vault sign-in and recovery protected","Required devices and browsers supported","Shared item membership scoped","Copied-secret and departure actions understood","Synthetic recovery and exit trial planned","Underlying accounts and permissions reviewed separately",[97,100,103],{"question":98,"answer":99},"Is a browser password manager automatically unsuitable for work?","No: evaluate the actual ownership, administration, sharing, recovery and device requirements. A built-in manager may fit one workflow and lack controls another business needs. Decide from supported behavior and a trial, rather than the product category alone.",{"question":101,"answer":102},"Does removing vault access invalidate the saved password?","No, the underlying account decides whether a credential remains valid. If someone may retain a copy, review account removal or password rotation and relevant sessions. Coordinate changes with legitimate users and integrations.",{"question":104,"answer":105},"Can a password manager also store passkeys?","Some products can, but support and business controls vary. Review the credential-provider model, supported devices, recovery and departure behavior. A password-storage feature does not prove that the same product has every passkey management capability you need.",[107,108],{"label":26,"url":27},{"label":35,"url":36},[110,113,116,118,121],{"path":111,"label":112},"\u002Fblog\u002Fpassword-manager-business","Compare and pilot a business password manager",{"path":114,"label":115},"\u002Fglossary\u002Fpasskeys","Understand passkeys and credential providers",{"path":14,"label":117},"Plan account changes during departure",{"path":119,"label":120},"\u002Fblog\u002Flost-mfa-device","Review an unavailable authenticator",{"path":13,"label":122},"Scope account ownership and authentication",{"title":124,"description":125,"button":126,"type":127},"Clarify who controls the credentials your business depends on","Describe the current tools and ownership concern without sending passwords. We can agree a practical access and recovery review.","Discuss credential ownership","check",[],[],{"name":131,"aliases":132},"Password manager",[133,134,135],"password vault","credential vault","business password storage",{"path":137,"label":138},"\u002Fresources","Website security resources and templates",{"path":140,"label":141},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134057749]