Who can see the company's shared passwords: a password manager rollout for a ten-person business
What Bitwarden, 1Password, Proton Pass, Keeper, NordPass, LastPass and Dashlane cost for ten people in October 2026 ($239 to $1,079 a year), what the cheap tiers leave out, why 'hide password' doesn't hide it, a vault-by-role layout, 2FA codes and passkeys in shared vaults, a ten-minute offboarding routine, and the breach numbers that make the case.
Ask a ten-person business where the company's logins live and you usually get three answers at once. A spreadsheet called "passwords" in someone's Drive. The browser of whoever set the account up. And a sticky note under the office manager's keyboard for the Wi-Fi, the alarm and the supplier portal. Ask who can see them and nobody is sure, which is the actual problem. When someone leaves, nobody knows which passwords they had, so nobody changes them.
A business password manager fixes that for the price of a coffee per person per month. This is what each one costs for ten people in October 2026, what the cheap tiers leave out, how to split the logins into vaults by role, how to take access back in ten minutes when someone leaves, and the numbers that make the case to the person who signs off the bill.
Why the spreadsheet and the browser don't work
Stolen and reused passwords are still how most break-ins start. Verizon's 2025 Data Breach Investigations Report found credential abuse was the most common way in, at 22% of breaches, and stolen credentials were the top hacking method in 33% of breaches at organisations under 1,000 people. A Verizon follow-up found only 49% of a person's passwords across services were distinct. In the 2026 report credentials were the data stolen in 31% of small-business breaches. IBM puts the average cost of a breach that started with compromised credentials at $4.67 million (2025), and they took 246 days to find and contain. Your number would be smaller; your business is smaller too.
Passwords saved in Chrome or Edge belong to the person's browser profile, not the company. Signed in to Chrome, they sync to that person's Google Account and leave with it. Google's sharing only works within a family group and hands over a copy that can't be taken back except by changing the password. Edge syncs for work accounts with Microsoft 365 Business plans, but there are no roles, no groups and no record of who saw what. And browsers are what infostealer malware empties first: Flashpoint counted 3.2 billion credentials stolen in 2024, 2.1 billion of them by infostealers, and Microsoft found 394,000 Windows PCs infected with just one of them, Lumma, in two months of 2025. Verizon found 46% of infected machines holding company logins were personal, unmanaged devices.
The spreadsheet has the opposite problem: everyone who can open it sees everything, forever, and a copy of it lives in every download folder it ever passed through. The UK's NCSC and the US CISA both say it plainly: use a password manager.
What it costs for ten people
Prices move. 1Password's own page showed two prices for the Starter Pack on the day we checked ($2.49 per user on the plan card, $24.95 a month flat in its FAQ; for ten people they come to the same thing), and a price tracker logged Keeper hiding and changing its prices several times in 2026. Take the table as the size of the bill, not a quote: somewhere between $240 and $1,080 a year for ten people, against $4.67 million for the average credential breach or, more realistically for a small firm, a lost week and a bank's fraud team.
What the cheap tiers leave out
The bottom tier of every vendor stores and shares passwords well enough. What it drops is control: groups, enforced policies, single sign-on and, at some vendors, the ability for an admin to get someone back in when they forget their master password. For ten people the last one matters most. Somebody will forget it.
For a ten-person business our pick on these terms is the 1Password Teams Starter Pack if one flat price and admin recovery matter most, or Bitwarden Teams if you want groups and an activity log and can live without admin recovery (keep two owners so one can always reach the vault settings). NordPass Teams is cheapest but has no shared folders, so sharing by role is clumsy. That's a judgement from the vendors' own comparison tables, not a test of each app; every one of them offers a 14-day free trial, and two people trying the import and sharing for an afternoon will tell you more.
Hiding a password doesn't hide it
Most of these products let you share a login so the person can use it but not see it: Bitwarden's "hidden passwords", 1Password Business's "View and copy passwords" permission, Keeper's privacy screen, Dashlane's and NordPass's "can autofill", LastPass's "hide passwords". Read the vendors' own documentation and they all say the same thing in different words. Bitwarden: hiding "does not completely prevent user access". 1Password: the data "could be extracted with some effort". Keeper: masking "is only visual in nature". Dashlane: "a determined, technically savvy recipient may be able to reveal the password". Proton refuses to offer the feature for that reason.
So treat any password a person can autofill as a password they know. Hiding is still useful (it stops casual copying into a chat or a spreadsheet), but it doesn't change what you do when they leave.
Vaults by role: a layout for ten people
The rule that makes everything else simple: a shared vault is only for accounts that genuinely have one login. Anything that offers a seat per person (Google Workspace or Microsoft 365, the bank, QuickBooks, Slack) gets a login per person instead, because then leaving means switching off one account, not changing a password six people use. Here's a layout for a ten-person studio with an owner, a bookkeeper, an office manager and seven staff.
The "keys to the kingdom" vault is the one that matters. Whoever holds the domain registrar and the email admin login can take over everything else, through password resets. Two people, both with 2FA, and nobody else. Our article on who owns the domain explains why the registrar login is the one to get right first.
2FA codes and passkeys in the same vault
Every manager in the table can store the six-digit codes for two-factor sign-in, and for a shared account like the company Instagram that is the practical answer: the team can post without waking the one person whose phone gets the code. The trade-off is real, though. Anyone who opens that vault has both factors. 1Password's own blog calls the loss "fairly negligible" next to the convenience, while admitting that "a true second factor is a device other than the one used to store your password". Our rule: codes for shared social and tool accounts can live in the shared vault; codes for the registrar, email admin, bank and the password manager itself stay on separate devices (an authenticator app or a security key), never inside the manager they protect.
Passkeys are where the products differ most. 1Password, Keeper and NordPass let you share them through shared vaults or folders. LastPass and Dashlane can't share passkeys at all, and LastPass won't transfer a vault that contains them. If you're moving the team to passkeys for shared accounts, check this before you choose.
When someone leaves: ten minutes
Removing someone from the manager doesn't always remove what they have. Bitwarden says devices keep a read-only offline copy of company items "for a short time" after removal. 1Password says items stay readable offline until the device next connects. On LastPass, "remove from company" turns the account into a personal one that keeps the vault's contents unless you choose otherwise. Keeper can only hand a departing user's vault to someone else if account transfer was switched on before they left. Hence the order below. The times are our own estimate for a ten-person setup like the one above, not a vendor figure.
This only works if the shared vaults are small and each login is in one place, which is the whole point of the layout above. A business that has everyone's logins in one spreadsheet can't do step 3 at all.
Rolling it out
The one thing a password manager doesn't do is stop someone being talked into a payment. That's the other half of small-business security, covered in a cloned voice asks for a wire, and you can put both on one page alongside your AI use policy.
Cyber insurers ask about MFA, shared admin accounts and how you remove leavers. See which of your answers would stop a quote, shrink the cover or raise the price, with the fixes in order. Runs in your browser.
Open the cyber insurance application checkSources
Prices and plans (read 25 Oct 2026): Bitwarden business pricing and plans; 1Password business pricing; Proton Pass for business; Keeper business plans; Dashlane pricing; NordPass business plans; LastPass pricing; price history from PricingSaaS on Keeper.
Sharing, hiding and offboarding: Bitwarden collection permissions, removing users, policies, import; 1Password permission enforcement, vault permissions, offboarding, recovery, import; Proton on hidden passwords; Keeper on hiding passwords and account transfer; Dashlane sharing permissions; NordPass access levels and passkey sharing; Dashlane on passkey sharing; 1Password on passkeys; 1Password on storing 2FA codes (Jun 2023); LastPass support topics on shared folders, hidden passwords, terminating users and passkeys (support.lastpass.com).
Breach data: Verizon 2025 DBIR and news release; Verizon on credential stuffing; Verizon 2026 DBIR executive summary; IBM 2025 Cost of a Data Breach (report copy here) and 2026; Flashpoint GTIR 2025; Microsoft on Lumma (May 2025); ICO fine on LastPass (Nov 2025).
Browsers and guidance: Google Chrome password help; Microsoft Edge enterprise sync (Aug 2026); Google on Chrome app-bound encryption (Jul 2024); NCSC small organisations guide (Apr 2026); CISA on strong passwords.