Password Management for Solopreneurs

Password management is the process of creating, storing, using, sharing, changing, and recovering business credentials throughout their lifecycle.

For a solopreneur, the password vault may contain access to:

• Business email
• Domain registration
• Website hosting
• Content-management systems
• Banking
• Payment processors
• Cloud storage
• Accounting software
• Advertising accounts
• Analytics
• Customer systems
• Source-code repositories
• Social accounts
• API credentials
• Client platforms

Remembering these passwords is not a realistic security strategy. The practical objective is to remember one strong primary passphrase while a password manager creates and stores the individual credentials.

Why Password Management Matters

Password reuse converts one exposed password into access to multiple accounts.

In Verizon’s analysis of devices infected with information-stealing malware, the median user had distinct passwords for only 49% of the services represented in the data. The same Verizon analysis found that credential-stuffing traffic represented a median 12% of authentication attempts for small organizations in the examined single sign-on logs.

These figures do not describe every internet user, but they illustrate why stolen credentials are valuable. Automated systems can test exposed email-and-password combinations against banking, ecommerce, hosting, cloud, and social platforms at scale.

A password manager breaks this chain by making every account use a different credential. If one service is breached, the exposed password should not unlock anything else.

What a Password Manager Does

A password manager—also increasingly called a credential manager—stores login information inside an encrypted vault.

Depending on the product, it may also:

• Generate random passwords
• Autofill credentials on matching domains
• Store passkeys
• Generate or store one-time authentication codes
• Identify reused passwords
• Warn about credentials found in breaches
• Store recovery codes
• Share selected credentials securely
• Synchronize credentials across devices
• Record password history
• Store secure notes and identity information
• Provide emergency-access options
• Export data for migration

The password manager reduces the number of credentials you must memorize. It does not eliminate the need for secure devices, multifactor authentication, recovery planning, or phishing awareness.

Password Manager Versus Browser Storage

Both browser-based and independent password managers are preferable to reusing or memorizing weak passwords. The right choice depends on how the business operates.

The UK National Cyber Security Centre states that browser and device password managers can be appropriate on devices you control. Its current NCSC guidance also notes that independent managers are useful when credentials must synchronize across different browsers and operating systems.

Do not save business credentials in browsers on public, borrowed, or unmanaged devices.

How to Choose a Password Manager

Do not choose solely by price, brand recognition, or the number of extra features. Evaluate the manager as critical business infrastructure.

Security Architecture

The provider should clearly explain:

• How vault data is encrypted
• Where encryption and decryption occur
• Whether the provider can access vault contents
• How the primary password is processed
• How synchronization is protected
• What account metadata remains visible
• How password resets and recovery work
• How passkeys and authentication codes are stored
• What happens when a device is lost
• How sessions can be revoked

“Zero knowledge” is a useful architectural claim only when the provider documents what it covers. A provider may be unable to decrypt vault contents while still processing email addresses, device information, billing records, IP addresses, or other metadata.

Strong Authentication

Prefer a manager that supports:

• Passkeys
• FIDO-compatible hardware security keys
• Authenticator applications
• Multiple registered authentication methods
• Session and device management
• New-login notifications
• Recovery-code generation
• Administrative change alerts

Email or SMS verification should not be the strongest available method for a vault containing critical business credentials.

Independent Security Review

Look for:

• Recent independent security assessments
• A vulnerability-disclosure process
• A security contact
• Published incident information
• Prompt software updates
• Clear support periods
• Documented cryptographic design
• A record of responding transparently to vulnerabilities

An audit is evidence about a defined system at a particular time. It is not a permanent guarantee that the product cannot be compromised.

Portability

Confirm that you can export:

• Login names
• Passwords
• Website addresses
• Notes
• Folder or collection information

Also determine whether passkeys, file attachments, password histories, and one-time-password seeds are exportable. These items may not transfer as easily as ordinary passwords.

A password manager without a practical export path can become a business continuity risk.

Sharing and Access Control

If contractors or collaborators need access, look for:

• Individual user accounts
• Shared collections
• Read-only access where supported
• Access expiration
• Activity logs
• Ownership transfer
• Immediate revocation
• Separation between personal and business vaults

A shared master password does not provide accountable sharing.

Recovery Options

Understand whether the provider offers:

• Recovery keys
• Emergency contacts
• Trusted-device recovery
• Administrative recovery
• Account recovery without vault recovery
• Delayed emergency access
• Offline emergency kits

Some recovery designs can restore the account but not decrypt the existing vault. Learn the difference before relying on them.

A Practical Password Standard

The 2025 revision of the NIST standard requires service providers to use a minimum of 15 characters when a password is the only authentication factor. A password used as part of multifactor authentication may be as short as eight characters. NIST also recommends permitting at least 64 characters and advises against mandatory character-composition rules.

Those figures are minimum requirements for systems verifying passwords. They are not a reason to limit passwords generated by a manager.

A practical solopreneur standard is:

Password length may need adjustment when a service imposes a lower limit or rejects particular characters. Do not weaken every password because one outdated service has poor requirements.

Create a Strong Primary Passphrase

The primary passphrase protects access to the password vault. It must never be reused for email, device login, banking, or any other account.

Create it from unrelated words chosen randomly—not from a quotation, personal sentence, song, keyboard pattern, business slogan, or predictable list.

Avoid using:

• Your name
• Family or pet names
• Birth dates
• Business names
• Website domains
• Favorite books
• Locations
• Repeated words
• Common quotations
• Predictable substitutions such as a to @
• A passphrase previously used elsewhere
• An example published in an article

Separators, numbers, and capitalization can be included, but length and unpredictability matter more than decorative complexity.

Practice entering the passphrase several times before depending on memory. Do not keep an unprotected digital copy in email, cloud notes, screenshots, or a document stored beside the vault.

If the consequences of forgetting it exceed the physical-theft risk, keep a sealed copy in a controlled physical location. Record when the copy was created and who could access it.

Protect the Password Manager Account

The password manager should receive stronger protection than an ordinary SaaS account because it concentrates access to many systems.

Configure:

1. A unique primary passphrase.
2. A passkey or hardware security key where supported.
3. A separately stored spare authentication method.
4. Login notifications.
5. Shorter vault locking on shared or portable devices.
6. Reauthentication before revealing or exporting credentials.
7. Biometric unlock only on trusted, encrypted devices.
8. Automatic application and browser-extension updates.
9. A documented recovery process.
10. A list of authorized devices and sessions.

Do not use the primary business email account as the only route for recovering the vault if that email password is stored inside the vault.

Set Up the Vault Safely

Install From an Official Source

Download the application and browser extension from the provider’s official website or an approved application store. Fake extensions and search advertisements may impersonate popular products.

Verify the developer name before installation.

Use Trusted Devices

Complete the initial setup on an updated device that you control. Avoid creating the vault on:

• Public computers
• Shared accommodation devices
• Client computers
• Unmanaged contractor devices
• Devices showing malware warnings
• Devices running unsupported software

Configure Automatic Locking

The vault should lock:

• After a short period of inactivity
• When the computer locks
• When the browser closes, where practical
• After the device restarts
• When switching accounts
• Before sensitive actions such as exporting data

A vault left unlocked on an unattended computer defeats much of the protection provided by its primary passphrase.

Review Clipboard Settings

Prefer autofill to manual copying. If credentials must be copied, configure automatic clipboard clearing where supported.

Remember that clipboard history, remote-support software, screen sharing, malware, and synchronized clipboards may expose copied information.

Use the Password Generator

Human-created passwords tend to contain patterns. A generator can create a credential without relying on names, dates, phrases, or familiar substitutions.

A useful default is:

• 20–24 characters
• Uppercase and lowercase letters
• Numbers
• Symbols when the service accepts them
• No ambiguous characters only when manual entry is likely
• A different password for every account

For a credential that will never be typed manually, additional length usually creates little inconvenience.

Do not modify a generated password by adding the service name or a predictable ending. That creates a pattern across the vault.

Save the Correct Website Address

Each login entry should contain the exact legitimate domain.

Autofill can provide a phishing warning because the manager normally offers a credential only on a matching website. The NCSC advice identifies domain-matched autofill as one of the security advantages of using a password manager.

If the manager unexpectedly refuses to autofill:

1. Stop.
2. Examine the complete domain.
3. Check for misspellings or misleading subdomains.
4. Open the service from a trusted bookmark or the vault entry.
5. Do not override the warning by immediately copying the password.

A failure to autofill is not proof of phishing, but it is a reason to verify the page.

Prioritize Accounts by Business Impact

Migrating hundreds of accounts in one session is unnecessary. Start with credentials capable of resetting, redirecting, or financing other systems.

Tier 0: Control Accounts

• Password manager
• Primary email
• Recovery email
• Device ecosystem account
• Domain registrar
• DNS provider
• Business bank
• Payment processor
• Mobile-carrier account
• Cloud identity administrator

Use a unique generated password or passkey, phishing-resistant authentication, login alerts, and independently stored recovery information.

Tier 1: Operational Accounts

• Hosting
• Website administration
• Cloud storage
• Accounting
• Source-code repositories
• Ecommerce administration
• Advertising accounts
• Customer databases
• Backup systems
• Automation platforms

These accounts can materially interrupt operations or expose customer and business data.

Tier 2: Business Tools

• Analytics
• Design software
• Scheduling
• Research tools
• Project management
• Communication tools
• Subscription services

Use unique generated passwords and MFA wherever supported.

Tier 3: Low-Impact Accounts

• Forums
• Trial accounts
• Low-value newsletters
• Replaceable utilities

Unique passwords still matter because a low-impact service can expose an email address and reused credential.

Organize the Vault

A vault should help you understand ownership and recovery—not become another unstructured inbox.

Useful categories include:

• Root accounts
• Finance
• Domains and hosting
• Websites
• Email and communication
• Customer systems
• Marketing
• Analytics
• Software
• Contractors
• Client-owned accounts
• Personal accounts
• Archived accounts

Each important entry can include:

• Official login address
• Account owner
• Username
• Generated password
• MFA method
• Recovery method
• Recovery-code location
• Billing owner
• Account identifier
• Support contact
• Renewal date
• Connected applications
• Last review date
• Special recovery instructions

Do not place the current MFA recovery code in a public label, title, or unencrypted field.

Separate Personal and Business Credentials

Complete separation is not always necessary for a one-person company, but the vault should clearly distinguish ownership.

A credential belongs in the business area when it controls:

• Business money
• Customer information
• A business domain
• Business intellectual property
• Paid business software
• Client work
• Business communication
• Revenue-producing websites

Separation makes future sale, succession, contractor access, and account closure easier. It also prevents a shared business collection from accidentally exposing personal accounts.

Decide Where to Store MFA Codes

Some password managers can store both the password and the time-based one-time password for an account.

This creates a tradeoff.

For lower-impact accounts, storing the password and one-time code in the same manager may be a reasonable convenience.

For the password manager, primary email, domains, financial accounts, hosting administrator, and other control accounts, prefer a passkey, hardware security key, or separately protected authentication method.

Never store the password manager’s only recovery code solely inside the vault it is meant to recover.

Use Passkeys Where Available

A passkey uses a cryptographic credential associated with the legitimate service. It cannot be reused across websites like a password and is resistant to conventional credential phishing.

The UK National Cyber Security Centre recommends choosing passkeys over passwords where available. Its 2026 passkey guidance reports that passkey login can be up to eight times faster than signing in with a password and a two-step verification code.

Passkeys may be:

• Synchronized across approved devices
• Stored in a credential manager
• Bound to one device
• Stored on a physical security key

Before adopting a passkey for a critical account, determine:

• Where it will be stored
• Which devices can use it
• Whether it synchronizes
• How a new device is added
• What happens if the device is lost
• Whether a password remains as fallback
• Whether recovery weakens the authentication
• Whether the passkey can be transferred to another manager

Do not delete a working fallback or recovery method until the passkey has been tested on the devices you expect to use.

Share Passwords Without Exposing Them

Do not share passwords through:

• Ordinary email
• Messaging applications
• Shared spreadsheets
• Project-management comments
• Video-call chat
• Screenshots
• Unprotected documents
• AI prompts
• Support tickets

Use the password manager’s sharing function when available.

For contractor access:

1. Create an individual account where the service supports it.
2. Assign the minimum role required.
3. Share a credential only when named access is impossible.
4. Set an expiration or review date.
5. Avoid sharing the vault’s primary password.
6. Revoke access when the work ends.
7. Rotate a shared credential after offboarding.
8. Review active sessions and connected applications.

Client credentials should remain client-owned whenever possible. Ask the client to grant named access rather than transferring control of the primary account.

Build a Vault Recovery Plan

Password recovery must cover more than forgetting the primary passphrase.

Plan for:

• A lost phone
• A failed computer
• Loss of the authentication key
• Forgotten primary passphrase
• Provider outage
• Corrupted local data
• Loss of access to the recovery email
• Accidental vault deletion
• Account suspension
• Owner incapacity
• Password-manager compromise

Create an emergency record containing:

• Password-manager name
• Official login address
• Account identifier
• Recovery method
• Recovery-key location
• Spare security-key location
• Trusted-device information
• Emergency-contact instructions
• Provider support process
• Date recovery was last tested

Store this record outside the vault in a controlled location. Do not make the emergency package so complete and accessible that finding it provides immediate access to the entire business.

Avoid Circular Recovery

A circular dependency occurs when:

• The vault depends on the primary email for recovery.
• The email password and recovery codes exist only inside the vault.
• The email account depends on the lost phone.
• The phone account also depends on the inaccessible email or vault.

At least one recovery route for critical credentials should remain usable when the primary device and primary email are unavailable.

Test Recovery

A recovery method that has never been tested is an assumption.

Without disabling working access, verify:

• The recovery key is legible.
• The spare security key is registered.
• The recovery email is accessible.
• Trusted contacts are current.
• The official support procedure is documented.
• A new trusted device can be added securely.
• Recovery does not depend entirely on the lost system.

Review recovery after changing phones, email providers, password managers, device ecosystems, or business ownership.

Migrate From Existing Password Storage

Migration may temporarily expose more information than ordinary vault use, especially when a browser or previous manager creates an unencrypted CSV export.

Use this process:

1. Update the old and new password managers.
2. Use a trusted device.
3. Prefer a direct importer when available.
4. Close unrelated applications.
5. Disconnect screen sharing and remote support.
6. Export only when required.
7. Import immediately.
8. Compare the number of imported records.
9. Check several critical entries manually.
10. Verify notes, folders, website addresses, and usernames.
11. Re-enroll MFA codes or passkeys that did not transfer.
12. Remove the unencrypted export.
13. Empty applicable trash or recovery locations.
14. Disable the old manager only after testing the new one.
15. Revoke old sessions and extensions.

Deleting an export does not guarantee that every copy has disappeared from synchronized storage, temporary files, backups, or solid-state media. Avoid creating an unencrypted export when another migration method exists.

Do Not Rotate Passwords Without a Reason

Routine password expiration often produces predictable modifications and additional administrative work.

Current NIST guidance says service providers should not require periodic password changes without evidence of compromise.

Change a password when:

• It has been exposed
• It was reused
• It was shared insecurely
• A contractor no longer requires it
• It is a default password
• It is weak or predictable
• The service reports a breach affecting credentials
• Malware may have captured it
• An unauthorized person accessed the vault
• The provider requires a reset for a legitimate security reason
• The account appeared in a credible compromise alert

Changing a unique, randomly generated password every 30 or 90 days does not provide the same value as eliminating reuse, enabling strong authentication, and detecting compromise.

Review Password Health

Use the manager’s security report to identify:

• Reused passwords
• Weak passwords
• Old manually created passwords
• Credentials found in breach data
• Accounts without MFA
• Duplicate entries
• Missing website addresses
• Expired shared access
• Inactive accounts
• Passwords still stored outside the manager

Treat health scores as prioritization tools, not absolute measures of security. A long password can still be exposed through phishing or malware, while an old unique password is not automatically compromised because of its age.

Respond to a Compromised Password

When one account password is exposed:

1. Open the legitimate service independently.
2. Change the password from a clean device.
3. Generate a new unique credential.
4. Revoke active sessions.
5. Review recovery methods.
6. Review MFA settings.
7. Remove unknown devices and applications.
8. Check whether account information was altered.
9. Inspect activity and transaction history.
10. Change any other account that reused the credential.

If every account has a unique password, exposure of one password should not require changing the entire vault.

Respond to Possible Vault Compromise

The response depends on what was affected.

Provider Security Incident

Determine:

• Whether encrypted vault data was accessed
• Whether account metadata was exposed
• Whether authentication secrets were affected
• Whether active sessions remain valid
• Which product versions are affected
• What the provider recommends
• Whether credible independent analysis exists

Do not rotate hundreds of credentials based only on an alarming headline. First establish whether vault contents, the primary credential, or active sessions were exposed.

Lost Locked Device

Use another trusted device to:

• Mark the device as lost where supported
• Revoke password-manager sessions
• Revoke device-account sessions
• Review recent vault activity
• Change credentials if the device may have been unlocked
• Remove device-bound passkeys when appropriate

Unlocked Device or Malware

If malware or an unauthorized person may have accessed an unlocked vault, assume that displayed, autofilled, or locally available credentials could be exposed.

Prioritize:

1. Password manager
2. Primary and recovery email
3. Domain and DNS
4. Financial accounts
5. Device ecosystem
6. Hosting and cloud administration
7. Payment processors
8. Customer-data systems
9. Other saved accounts

Also rotate exposed API keys, recovery codes, passkeys, and authentication seeds where necessary. Password changes alone may not invalidate stolen sessions.

Password Management Metrics

Useful measurements include:

• Percentage of active accounts stored in the manager
• Percentage using unique passwords
• Percentage of control accounts using passkeys or hardware keys
• Number of reused passwords
• Number of weak passwords
• Number of exposed credentials awaiting action
• Number of former collaborators with access
• Number of accounts without a documented owner
• Number of critical accounts with only one recovery method
• Age of the last recovery test
• Number of unencrypted credential files
• Number of shared credentials awaiting rotation

Example calculations:

Unique password coverage = accounts with unique passwords ÷ active accounts × 100

Strong authentication coverage = protected control accounts ÷ total control accounts × 100

Vault coverage = accounts stored in the approved manager ÷ known active accounts × 100

The most useful target is not a perfect vendor-generated score. It is complete coverage of critical accounts, no password reuse, and a recovery method that works.

Common Password Management Mistakes

• Reusing the primary passphrase elsewhere
• Storing the primary passphrase in the same vault without an independent recovery method
• Protecting the vault only with SMS
• Saving credentials on shared devices
• Creating predictable password patterns
• Using one password with different service-name endings
• Sharing credentials through email or chat
• Keeping passwords in spreadsheets
• Leaving browser exports on the computer
• Ignoring saved passwords on an old phone
• Storing the only MFA recovery code inside the protected vault
• Treating autofill failure as an inconvenience rather than a warning
• Giving contractors the primary account
• Failing to rotate shared passwords after offboarding
• Keeping duplicate credentials in several unmanaged systems
• Choosing a manager without checking export options
• Assuming a security audit guarantees future safety
• Changing every password periodically while leaving reuse unresolved
• Moving passwords without checking whether passkeys and MFA seeds transferred
• Failing to test vault recovery

A 60-Minute Password Management Setup

First 15 Minutes

1. Choose and install a reputable password manager.
2. Create a unique primary passphrase.
3. Enable a passkey, security key, or strongest available MFA.
4. Save the recovery information outside the vault.
5. Configure automatic locking and updates.

Next 20 Minutes

1. Add the primary email.
2. Add the recovery email.
3. Add the domain registrar and DNS provider.
4. Add financial and payment accounts.
5. Replace reused passwords with generated ones.
6. Review active sessions on these accounts.

Next 15 Minutes

1. Add hosting, cloud storage, accounting, and website administration.
2. Enable strong authentication where available.
3. Store recovery codes appropriately.
4. Remove obsolete administrators.

Final 10 Minutes

1. Run the password-health report.
2. Remove any temporary export.
3. Register a spare recovery method.
4. Record the recovery-test date.
5. Schedule a quarterly vault review.

Password Management Checklist

1. Select one approved password manager.
2. Install it from an official source.
3. Create a unique primary passphrase.
4. Do not reuse the primary passphrase.
5. Enable phishing-resistant authentication.
6. Register a spare authentication method.
7. Store recovery information outside the vault.
8. Test the recovery process.
9. Configure automatic vault locking.
10. Enable automatic updates.
11. Review authorized devices.
12. Enable new-login alerts.
13. Import existing credentials safely.
14. Remove temporary export files.
15. Replace reused passwords.
16. Replace weak passwords.
17. Replace default passwords.
18. Generate a unique password for every account.
19. Use at least 20 characters for generated passwords where supported.
20. Save the legitimate website address with each login.
21. Prefer autofill to clipboard copying.
22. Investigate unexpected autofill failures.
23. Prioritize email, domain, financial, and device accounts.
24. Enable passkeys where appropriate.
25. Understand how passkeys are synchronized and recovered.
26. Keep critical MFA separate where justified.
27. Do not store the vault’s only recovery code inside the vault.
28. Separate personal and business credentials.
29. Organize credentials by ownership and business function.
30. Use individual contractor accounts.
31. Share credentials only through controlled vault sharing.
32. Set access-review dates.
33. Revoke access after each engagement.
34. Rotate credentials that were shared.
35. Review breach alerts.
36. Review password health quarterly.
37. Remove closed or obsolete accounts.
38. Confirm that the vault can be exported.
39. Document non-transferable passkeys and MFA seeds.
40. Review recovery after every device or provider change.

Frequently Asked Questions

What is password management?

Password management is the controlled creation, storage, use, sharing, monitoring, replacement, and recovery of passwords and related credentials. It normally uses a password manager to maintain a different random password for every account.

Should a solopreneur use a password manager?

Yes. A password manager makes unique random passwords practical across business accounts. It also provides centralized credential updates, breach alerts, controlled sharing, and recovery information.

Is it safe to keep every password in one manager?

Concentration creates risk, but a well-protected manager is generally safer than password reuse, predictable patterns, spreadsheets, or credentials scattered across browsers and messages. Protect the vault with a unique passphrase, strong authentication, secure devices, and tested recovery.

What is the safest type of password manager?

There is no universally safest product. Evaluate encryption design, authentication, recovery, independent assessments, update history, platform support, export capability, security notifications, and sharing controls.

Are browser password managers safe?

They can be appropriate on trusted, updated devices, especially when the owner works within one browser or device ecosystem. An independent manager may offer better cross-platform support, business sharing, portability, and administrative controls.

How long should a password be?

NIST’s current minimum for a password used as the only authentication factor is 15 characters. A manager-generated business password can reasonably use 20–24 random characters or more where the service permits it.

Does a password need numbers and symbols?

A password does not become secure merely because it contains a capital letter, number, and symbol. Length, randomness, uniqueness, secure storage, and strong authentication matter more. A generator can include every character type accepted by the service.

Should passwords be changed every 90 days?

Not automatically. Change a password when it is weak, reused, shared, exposed, default, or suspected of compromise. Routine expiration can encourage predictable variations without addressing the underlying risk.

What is a primary password?

The primary password or passphrase unlocks the password manager. It should be long, unique, memorable, and never used for another account.

What happens if I forget the primary passphrase?

The outcome depends on the manager’s recovery design. Some providers offer recovery keys, trusted contacts, devices, or administrative recovery. Others cannot restore an encrypted vault. Configure and test recovery before relying on the manager.

Should I write down the primary passphrase?

A securely stored physical copy may be reasonable when accidental lockout is a greater risk than unauthorized physical access. Do not leave it beside the computer, in a wallet, or in an ordinary cloud document.

Should MFA codes be stored in the password manager?

It depends on the account. Storing passwords and codes together improves convenience and still prevents many password-only attacks, but it reduces separation if the vault is compromised. Use separate or phishing-resistant authentication for critical control accounts.

Are passkeys better than passwords?

Passkeys are resistant to conventional phishing and cannot be reused across services. They are generally preferable when the service, device, synchronization, and recovery model meet the business’s needs.

Does a passkey replace the password manager?

Not necessarily. Credential managers commonly store both passwords and passkeys. Businesses will continue to need passwords for services that do not support passkeys and may use the same manager for both credential types.

Can a password manager be hacked?

Any software can have vulnerabilities or operational failures. The relevant question is what an attacker could obtain and whether the vault remains protected. Strong architecture, independent review, prompt updates, strong account authentication, and secure devices reduce the risk.

What should I do after receiving a compromised-password alert?

Open the service independently, replace the password with a new generated one, revoke active sessions, review recovery and MFA settings, and check account activity. Change other passwords only if the exposed credential was reused.

Is autofill safer than copying a password?

Autofill can be safer because the manager checks the website domain before offering the credential. Copying bypasses that domain check and may expose the password through clipboard history or monitoring software.

Can I email a password to a contractor?

Do not send business passwords through ordinary email. Create an individual service account or use controlled password-manager sharing. Revoke access and rotate shared credentials when the engagement ends.

Should business and personal passwords use different managers?

They do not always require different products, but they should be separated into clearly controlled vaults, profiles, or collections. Business credentials should remain transferable and accessible under the business’s continuity plan.

How often should the password vault be reviewed?

Review it at least quarterly and after a breach, contractor departure, device loss, provider migration, or major business-system change. Alerts involving critical credentials should be handled immediately.