Every office has them: one password taped under a keyboard, texted to every new joiner, unchanged since the person who set it left in 2022. Shared passwords feel convenient right up until the day they quietly become the breach, the mystery, or the lockout nobody can fix.
A shared password fails in three predictable ways. It spreads - every joiner, temp and visitor who hears it keeps it forever. It cannot be revoked - changing it locks out the whole office, so nobody ever changes it, even after someone leaves. And it destroys accountability - when every login is the same name, the logs cannot tell you who did anything. This page names the usual shared passwords hiding in a small office and gives the practical replacement for each: individual accounts where the system allows them, and a team password-manager vault where sharing is genuinely unavoidable.
Walk the building mentally and list them: the shared info@ or office@ mailbox, the Wi-Fi password that has never changed, the router and NAS admin logins, the accounting package admin, the social media accounts, the PC in the corner that everyone signs into as the same user.
For each one ask two questions. Does this system support individual accounts? And who, exactly, knows this password today - including everyone who has ever left? The second answer is always longer than anyone expects, and it is the real risk statement.
Most modern systems quietly support what offices never set up: separate named logins. Email systems allow shared mailboxes that staff open with their own credentials - the shared address survives, the shared password dies. Accounting and line-of-business software usually supports per-user accounts too, often already included in the licence you pay for.
Individual accounts fix all three failures at once. Access can be granted and removed per person, logs name a human, and a password change affects one desk instead of shutting the office for a morning.
Some logins genuinely are shared: a supplier portal with one account, a social profile, a device panel. For those, the password lives in the team vault of the office password manager, shared with exactly the people who need it, and nowhere else - not in chat, not in email, not on paper.
Then set the rule that makes vaults work: when a person who had access leaves, that password changes the same week. Because the vault updates centrally, the change takes minutes instead of becoming the office-wide event everyone avoids.
Here is the honest audit you can run in five minutes. Pick a person who left your office in the last year. List everything they could still sign into tonight from their home. Shared passwords dominate that list almost every time.
Fix in order of damage: email and remote access first, then banking and accounting, then the device admin panels. If the list scares you, good - it is supposed to, once, in a planned meeting, rather than during an incident investigation.
Every essential in this guide is explained with full knowledge and installation in the IT Security Essentials video.
Watch Full VideoTrust is not the issue - reach is. A trusted person's phone gets stolen, their home PC gets infected, or they get phished, and the shared password they legitimately knew is now in an attacker's hands with no way to revoke it for one person only. Individual accounts protect the trusted people, not just the office.
Usually not. Microsoft 365 and Google Workspace both offer shared mailboxes that each person opens with their own login - no shared password exists at all. The sender still sees the shared address. Check your plan before assuming the password is necessary.
On two triggers: whenever any person who knew them leaves or changes role, and at least once a year regardless. Store the new one in the vault immediately - the change is only real once everyone gets it from the vault, not from a message thread.