Shared spreadsheets, chat messages and sticky notes are how team credentials leak. A team password manager gives everyone strong, unique passwords, shares access by role, and removes access cleanly when someone leaves. You can use a hosted service or self-host on your own VPS. Here’s how the main options compare.
What a team password manager should do
- End-to-end encryption: the server stores only encrypted vaults, and decryption happens on users’ devices.
- Sharing by collection or group: “Production servers” for ops, “Marketing tools” for marketing.
- Granular permissions: view-only, hide passwords, manage.
- Offboarding: remove a user and their access to shared items ends. Then rotate the passwords they could see.
- MFA for every member, and ideally SSO with your identity provider.
- Audit logs: who accessed or changed what.
- Browser extensions and mobile apps, so people actually use it.
The main options
| Option | Hosting | Notes |
|---|---|---|
| Bitwarden | Cloud or self-hosted | Open source, polished apps. Organisations with collections, groups and SSO (paid tiers) |
| Vaultwarden | Self-hosted | Lightweight, Bitwarden-compatible server (Rust). Works with the official Bitwarden apps |
| 1Password | Cloud only | Very polished, strong team features, secret automation for DevOps |
| Passbolt | Self-hosted or cloud | Open source, built for teams, GPG-based sharing |
| KeePassXC + shared file | File on a share or sync | Free and offline, but weak for teams: no per-item permissions, risk of sync conflicts |
| Psono, Padloc | Self-hosted or cloud | Smaller open-source alternatives |
For most small teams, Bitwarden (cloud) or Vaultwarden (self-hosted) is the sweet spot: open source, good apps and reasonable cost.
Self-hosting Vaultwarden on a VPS
Vaultwarden is small (tens of MB of RAM) and runs well on the smallest VPS plans. It needs:
- Docker (or the binary), behind a reverse proxy with HTTPS (mandatory, since browsers refuse Web Crypto on plain HTTP);
- a domain name, such as
vault.example.com; - backups of its data directory (the SQLite database plus attachments);
- SMTP for invitations and alerts.
Full guide: Vaultwarden on a VPS.
Key settings for a team instance:
SIGNUPS_ALLOWED=false # only invited users
INVITATIONS_ALLOWED=true
ADMIN_TOKEN=<argon2 hash> # protect /admin, or disable it after setup
DOMAIN=https://vault.example.comSelf-hosting responsibilities
Self-hosting gives you control, but you own:
- Security of the server: updates, firewall, key-only SSH. See Linux server hardening.
- Availability: if the server is down, apps still work from their cached vaults, but you can’t sync or add devices.
- Backups: encrypted, off-server, tested. Losing the database means losing every team secret. See GPG encryption.
- Updates to Vaultwarden itself. Watch its releases.
Consider restricting access to the vault through a VPN or IP allow-list, if your team works from known locations. See zero trust networking.
Organising a team vault
- Collections by system or role:
Infrastructure,Production DBs,Marketing,Finance. - Groups map to people’s roles. Assign collections to groups, not individuals.
- Personal vaults stay private. Encourage people to keep personal accounts out of work vaults.
- Store more than passwords: SSH key passphrases, API keys, recovery codes, licence keys, secure notes for runbooks.
- Emergency access: at least two people with owner or admin rights. Store a sealed recovery kit (master password hint process, recovery codes) offline.
Rollout tips
- Require MFA for all members from day one.
- Move credentials from spreadsheets and chats into the vault, then rotate them, since the old copies were exposed.
- Train people briefly: install the browser extension, use the generator, never reuse passwords.
- Write an offboarding checklist: remove from the organisation, then rotate everything in the collections they could access.
- Review access quarterly.
Password managers vs secrets managers
Password managers are for people. Application secrets (database passwords that apps use, API keys in deployments) belong in environment files, secret stores or CI secrets. See secrets management. Some tools (1Password, Bitwarden Secrets Manager) cover both.
Related: Vaultwarden on a VPS and brute-force protection.