In every small company we walk into for the first time, we find the same three things. Sticky notes with passwords under the bookkeeper's keyboard. A passwords.xlsx file on a shared drive that "almost everyone" can open. And a Messenger chat where someone pasted the hosting panel password three years ago. A password manager solves this problem for pennies, but almost nobody rolls it out, because "it worked somehow until now".
It works until it works against you. This is not paranoia. Passwords kept "somewhere" are one of the three things that make SMEs lose access, money or customers — along with phishing and a missing backup. A password manager is the cheapest tool that simply switches off most typical loss scenarios.
Why this isn't "IT paranoia"
Three real scenarios from Polish SMEs we walked into recently:
- A former employee with a still-active password. A salesperson left a year ago. The password to the online shop panel, which sat in a shared Google Sheet, nobody changed. Two months after they left, price changes started appearing on products that weren't in the catalogue. Nobody knew it was them until we checked the logs.
- A LinkedIn password reused for company email. An office manager used the same password on LinkedIn (leaked in 2024) and Microsoft 365. Six months after the leak, someone logged in as her and set up a rule to forward invoices to their own inbox. We only spotted it when a customer asked why they'd received an invoice with a different bank account number.
passwords.xlsxattached to a quote by accident. An employee was sending a product catalogue to a customer and attached, by mistake, a spreadsheet with admin passwords. The customer was honest and called. The next one might not be.
All three are the result of the same thing: passwords sit somewhere nobody actually controls who can see them.
What a password manager actually does
A password manager is an encrypted vault for credentials. Everyone in the company has their own vault, opened with one master password (the only one they have to remember). The rest — hundreds of logins to various services — sits inside, encrypted. The manager pastes them into login boxes for you, generates new ones (long, random, different for every service), and syncs them between your laptop and phone.
The second reason to use one: safe password sharing. Instead of pasting the hosting panel password into a team chat, you add it to a shared folder in the manager. The five people who should see it see it in their vault. The rest don't. When someone leaves, you revoke their access in one click, and the manager immediately shows you the list of passwords that need to change.
The third reason: visibility. The manager shows you how many weak passwords you have, how many are reused, which ones leaked in known breaches. You don't guess — you see.
What to choose: cloud, self-hosted, free
For 90% of SMEs the sensible default is Bitwarden or 1Password in their business tier — cloud-based, proven, integrate with Microsoft 365 and Google Workspace, have audited compliance. Typical cost is 15–25 PLN per user per month. For a 20-person company that's around 400 PLN monthly — less than one bookkeeping invoice.
Bitwarden also has a self-hosted option (Vaultwarden) that runs on your own server. Sensible for firms that already have an admin keeping servers up — otherwise it's saving 400 PLN at the cost of eight hours a month of maintenance work. Not worth it.
What to avoid: KeePass as the sole company tool. Great for a single technical person, but it requires manual file syncing between people — in a 15-person company nobody will maintain that. After three months the sticky notes come back.
A real example
At one of our clients — a 24-person car parts wholesaler — the Comarch Optima admin password and the bank logins sat in a Google Sheet that 9 people had access to, including two former employees. The Optima password hadn't been changed in four years. Nobody could answer the question of who should actually know it today.
Rolling out Bitwarden took us three weeks:
- Week 1 — inventory: we listed every password from the spreadsheet, the sticky notes and people's heads. The total came to 187 unique credentials. 62 of them were no longer used.
- Week 2 — training and migration: one evening session for the whole team (90 minutes), plus four 30-minute individual sessions for people who "aren't good with computers".
- Week 3 — reset and cleanup: all passwords to the critical systems (Optima, bank, email, shop) were changed, the former employees were cut off, the Google Sheet was deleted.
Concrete results after three months: onboarding a new salesperson dropped from 90 minutes of "sending logins around" to 15 minutes of granting access in one tool. Calls to the office asking "what was the password to…" dropped from about six a week to zero. Cost: 480 PLN per month in licenses + a one-off 12 hours of our work for the rollout.
How to roll it out without a team revolt
A password manager is one of those things where the first two weeks are painful and from week three nobody wants to go back. Four things that decide whether the rollout sticks:
- Don't try to migrate every password at once. Start with the 5–10 most important ones (email, bank, ERP, hosting panel). The rest migrate themselves, as people use them, within a month.
- Show concretely what the employee gets out of it. "Because security" doesn't work as an argument. "Because you'll never have to call for a password reset again and won't have to remember 40 different passwords" does.
- Introduce one rule: any password you change today goes into the manager. Don't chase people for what still sits in the spreadsheet. The fact that daily work is more comfortable in the manager does the rest.
- Turn on MFA on the manager itself. The master password is the single point of failure — it must be protected with a second factor. Ten minutes of setup you cannot skip.
Password manager vs MFA and offboarding
A password manager doesn't replace MFA — it complements it. MFA protects against the use of a stolen password; the manager makes the passwords strong and unique enough that cracking them isn't worth the attacker's time. Together they give a level of security that, for a small company, is absurdly high relative to cost.
The other thing: the manager solves 80% of employee offboarding. Instead of trying to remember which systems someone had access to, you look at their folder in the manager — and you know which passwords have to change. Without it, offboarding is guesswork.
Where to start next week
You don't need a strategy. You need a decision and one afternoon:
- Pick the tool (for most companies: Bitwarden Teams or 1Password Business — the differences are cosmetic).
- Start with your own account and the account of whoever handles finance. See how it works before you make the rest of the team switch.
- Take inventory: where do company passwords actually live. Spreadsheet, sticky notes, chat, the bookkeeper's head.
- Plan one short training session for the team (60–90 minutes). Not longer.
- After a month go back to the list and check how many passwords still sit outside the manager. Those are your real to-do list.
If you don't know which tool to pick, or how to introduce it without the team grumbling about "yet another login window" — talk to someone who rolls these things out in Polish SMEs every day. The first call is free and takes half an hour.
A password on a sticky note isn't security. It's just waiting for someone else to reach for it.