Every nonprofit has one. A spreadsheet called Logins. A shared note. A sticky on a monitor. Or the version where the executive director is the spreadsheet and everyone texts her.
It persists for a reason, and it’s not laziness.
The problem isn’t memory. It’s sharing.
Most advice about password managers talks about remembering passwords. That is not why your spreadsheet exists. It exists because several people genuinely need the same login — the Facebook page, the donation platform, the shared mailbox, the account that holds the photo library.
Better memory does not solve that. A tool built for sharing does.
What a shared vault changes
A password manager stores credentials encrypted and fills them in for you. What matters for an organization is the shared vault: one entry that several named people can use, without any of them needing to know the password itself.
- Nobody emails or texts a credential again. You grant access instead of sending a secret.
- You can see who has access to what—which, right now, you most likely cannot.
- When someone leaves, you remove them from the vault. You don’t change twelve passwords and notify everyone.
That last one deserves a moment. The usual reason a departed volunteer still has access six months later is that revoking it would mean changing a shared password and telling eight people the new one. Nobody wants to do that on a Friday afternoon. A vault removes the excuse.
What good looks like
- Everyone has their own account and personal vault.
- Shared vaults are organized by function rather than by person: Finance, Communications, Programs.
- The browser extension becomes the normal way everyone signs in. If people are still typing passwords, it hasn’t landed yet.
Which manager you choose matters far less than choosing one. Any reputable manager with shared-vault support will do this job.
Getting it actually adopted
This is where these projects usually die. The rollout that works is a small one:
- List the accounts that more than one person uses. Most organizations find somewhere between five and ten.
- Put only those into a shared vault this week.
- Add everything else over the following month, as people reach each account naturally.
- Don’t announce a policy. Make the vault the easiest path and let it spread on its own.
One caution
The vault becomes the most valuable thing your organization owns. Its own password has to be long, unique, and written nowhere else — and it has to have multifactor authentication on it. Which is exactly what the next post is about.
This week
Open a document and list every account that more than one person at your organization uses. That list is your first shared vault, and writing it takes about ten minutes.