Every small business I've talked to has the same dirty secret: one Gmail account, one bookkeeping login, one Canva seat, and the password is written on a sticky note or in a shared Google Doc called logins-FINAL-real.docx. It worked at five poeple. At fifteen, it's a fire waiting for a match.
The problem isn't really security in the abstract. It's the four smaller problems hiding inside it. One, you can't tell who did what. When the QuickBooks entry gets deleted, nobody knows who was logged in. Two, you can't rotate. Somebody quits, and now you're changing 40 passwords across 40 sites and hoping you got them all. Three, MFA breaks. The 2FA code goes to one phone, and that person is on vacation in Maine. Four, onboarding takes half a day of someone reading passwords out loud.
Any one of those is annoying. All four together, at 15+ staff, cost you real hours every week. That's the math that makes a password manager pay for itself in a month.
I've deployed both. For a small business, 1Password Business is the easy call at around $8/user/month — the admin console is friendly, the browser extension doesn't fight you, and the shared vault model matches how a small team actually works (a vault for Finance, a vault for Marketing, a vault for Ops, done). Bitwarden Teams is roughly half the price and does the job if you have somebody technical who doesn't mind a slightly rougher UI. Both do MFA, both do secure sharing, both do emergency recovery.
What you're not doing: rolling your own with a spreadsheet in a shared drive, using the browser's built-in password memory as your system of record, or waiting until you get to 25 people. The migration is harder at 25 than at 15. Do it now.
Monday, pick the tool and buy seats for everyone plus two extras. Tuesday, you (the owner) set up the vault structure and import your own passwords first — do it on yourself before you inflict it on staff. Wednesday, run a 30-minute all-hands: install the extension, log in, add one password together. Thursday and Friday, each person migrates their own logins into their personal vault; shared accounts go into the department vaults you built. Following Monday, delete the sticky notes and the shared doc. Actually delete them.
The whole thing costs you about $150/month for a 15-person team and roughly six hours of setup. If somebody quits three months from now, offboarding their access takes about four minutes instead of an afternoon. That's the trade.
If your team is somewhere north of ten people and the sticky-note situation is starting to keep you up at night, this is exactly the kind of cleanup we help small offices run in a week. Drop us a note.
— Alexander @ SBATC
