The Little Padlock Has No Owner: A Twenty-Minute Sweep of Your Shared Password Vault

In plenty of small UK organisations, the password manager starts as a sensible idea and quietly becomes a shared drawer. One vault. One login. Someone set it up a couple of years ago, probably the person who also sorted out the Wi-Fi. It might be 1Password, Bitwarden, Dashlane or a KeePass file on a share. The product does not really matter. The question is not ‘do we have a vault?’ It is ‘who owns what is in it?’ A vault without owners is not a security control. It is a single point of failure with a friendly interface.

Why this is worth twenty minutes

If one person is off sick, resigns or wins the lottery and leaves, can anyone else get into the vault? If the answer is ‘probably’, you have a problem. Shared vaults also collect junk: supplier logins for services you cancelled, duplicate admin accounts, test entries, and credentials for people who left months ago. None of that shows up in a monthly invoice, so nobody notices.

For a small team, the vault is also a rough map of how the business runs. If the map is wrong, your response to a lost laptop or a dodgy invoice is going to be wrong too. This is not about passing an audit with flying colours. It is about making sure the thing you rely on every day is not the quietest weak point in the building.

Before the clock starts

Do this with two people and one screen. Do not export passwords to a spreadsheet, and do not start resetting things halfway through. The point is to see the shape of the vault, not to fix everything in one sitting. Set a timer for twenty minutes. Keep a notebook or a blank document open for anything that needs follow-up.

Minute 0–3: Confirm the escape hatch

Find the emergency access or account recovery settings. Who can recover the vault if the main owner is unavailable? Is it one person, or is it a proper break-glass arrangement with a deputy? If the answer is ‘the MD set it up and never logs in’, note that down. Test the recovery process far enough to know it works. In UK teams, keep the recovery kit somewhere sensible and offline, such as an office safe, rather than in a shared inbox called ‘admin stuff’.

Minute 3–10: Sort the entries into four piles

Open the full item list, but do not read the passwords. You are sorting, not snooping. Put each entry into one of four buckets:

• Shared role accounts: finance@, admin@, IT@ and similar.
• Supplier and service logins: payroll, hosting, domain registrar, insurance portal.
• Personal accounts stored in the shared vault: someone’s email, LinkedIn, or a personal shopping login that ended up in the wrong place.
• Dead or unknown: old suppliers, test entries, duplicates, things nobody can explain.

You will not get this perfect in seven minutes. You are looking for patterns, not producing a work of art.

Minute 10–15: Hunt the orphans

Use the vault’s search box. Try terms like ‘old’, ‘backup’, ‘test’, ‘temp’, ‘admin’ and the names of anyone who has left. Look for duplicate entries for the same service. Two Microsoft 365 admin accounts is a classic. Check the last-modified dates. Something untouched for a year is not automatically bad, but it deserves a question.

Also look for shared credentials that were created for a project and never retired. If a supplier login was only meant for a six-week migration in 2024, it should not still be sitting there with a password half the team knows.

Minute 15–18: Check who can see what

Most vaults have collections, folders or shared vaults. If there is one folder called ‘Shared’ that everyone can open, you have rebuilt the shared drawer with better branding. Split access by role: Finance, Operations, Client Work. Give access to groups rather than individuals where the tool allows it. Check whether anyone has shared a single item with a contractor and then forgotten about it.

Minute 18–20: Write the ownership rule

This is the bit that stops the vault drifting back into a mess. Every collection, and ideally every important entry, needs:

• a named human owner, not ‘IT’ or ‘the team’
• a deputy who can step in
• a review date, quarterly is plenty
• a rule that personal accounts do not live in shared collections
• an offboarding step: remove vault access and rotate any shared credentials the person could see

The bit people skip: rotation after departure

If someone left and they had access to a shared supplier login, changing their vault access is not enough. The password itself needs changing. Make a list during the audit. In the next week, rotate the important ones first: domain registrar, payroll, banking, main email admin and web hosting. Do not try to do all 87 at once. You will get bored and skip the one that matters.

Emergency access is not a spare key under the mat

Test it properly. Have two authorised people. Store the recovery kit securely offline. Put the process in your incident notes, even if that is a single page in a shared document. If the vault is cloud-based, make sure MFA is switched on for the vault account itself. You have just spent twenty minutes treating it as important. Protect it like it is.

What good looks like after twenty minutes

You will not have a perfect vault. You will have a list of orphaned entries, a decision on personal versus shared accounts, a named owner for each collection, and a date in the calendar for a review. That is enough to stop the vault being the quietest single point of failure in the business.

The vault is not a filing cabinet. It is a set of keys with a sign-out sheet. If nobody owns the sheet, you do not have control. You have a drawer.