From Sticky Notes to Enterprise Vault: A 7-Person IT Team's Password Manager Journey

A few days ago on r/sysadmin, I saw a post that hit close to home. A sole IT ops guy at a 7-person company wrote: “Our company loves to write passwords on sticky notes. I want to change this.” His situation was painfully familiar—3 developers, a couple of non-tech staff, and him as the only person who understood password management. The comments were full of people nodding along: for small companies, the biggest pain point isn’t the technology. It’s getting anyone to care.

Last year I helped a 15-person design team build a password management system from scratch. I made every mistake you can imagine. Here’s what I learned, broken down so you don’t have to repeat my failures.

Step 1: Don’t Pick a Tool Yet. Figure Out What You Actually Need.

The most common trap is jumping straight to “which password manager is best.” Stop. Answer three questions first:

1. How many people? A team of 5 has completely different needs from a team of 50.
2. Any compliance requirements? Finance or healthcare? You need audit logs. Non-negotiable.
3. What’s your team’s tech level? All developers, or a mix of designers, sales, and PMs?

I once saw a small company roll out an enterprise-grade solution. Three months of configuration later, the sales team refused to use it and kept sending passwords over WeChat. The best tool in the world is useless if nobody uses it.

Step 2: Feature Comparison—Don’t Fall for the Marketing Fluff

Here’s a real-world comparison of the major enterprise password managers. I’ve tested all of these in production environments:

Here’s the honest truth: Bitwarden self-hosting is a double-edged sword. You own your data completely, but you also own the maintenance—server, database, backups. I’ve seen teams forget to update their self-hosted instance, the database crashes, and every password is gone. The Reddit thread on that was brutal, but that’s the reality.

Step 3: Execution—The Hard Part Isn’t Tech, It’s People

This is the part that the Reddit post and my own experience agree on:

3.1 Recovery Keys Must Be Physically Backed Up

The guy in the r/sysadmin post said something I think is absolutely correct: “Set up a process where recovery keys get printed, sealed, and stored in a physical safe or with your accountant before day one, not after.”

Why? Because a password manager is itself a single point of failure. If someone forgets their master password, loses their hardware token, or gets hit by a bus (harsh, but this is real business continuity), without a recovery key, your entire company is paralyzed.

Here’s what I recommend:

• Print 3 copies of the recovery key
• One in the company safe
• One with your accountant or legal counsel
• One in a bank safety deposit box
• Each copy sealed with a tamper-evident bag

3.2 Skip “Company-Wide Training.” Go With “Force + Guide.”

Training sessions for small teams are a waste of time. Do three things instead:

1. Force an import: Dump every known company password into the manager, then shut down all other password transmission channels
2. Browser extension mandate: Force everyone to install the browser extension for auto-fill
3. Set up shared folders: Put shared accounts (AWS root, GitHub org) in there with minimal permissions

3.3 Start With the Worst Offender

Don’t try to fix everything at once. Pick the most painful scenario first—like database passwords on a sticky note, or SSH keys shared over Slack. I started with the AWS root account because the password was literally taped to a monitor bezel. Anyone walking by could see it.

FAQ

What is the best way to manage passwords for a business?

It’s not about buying the most expensive tool. It’s about establishing a password lifecycle management process: create → store → share → rotate → revoke. Tools are just carriers; the process is the core. Start with a password inventory, then build a permission matrix, then pick the tool.

What is the 8-4 rule for passwords?

The 8-4 rule means passwords must be at least 8 characters and include 4 character types (uppercase, lowercase, numbers, special symbols). Honestly, with modern password managers and MFA, this rule is outdated. Better to use the password manager to generate 16+ character random passwords, combined with TOTP or hardware security keys.

How to start with a password manager?

1. Choose a tool that supports emergency access (1Password and Bitwarden both do)
2. Create the master account, set up recovery keys, and physically back them up
3. Import existing passwords via CSV or manually
4. Create shared folders and assign permissions by team
5. Force everyone to install the browser extension
6. Close all old password transmission channels (WeChat, email, sticky notes)

What’s the best password manager for business use?

There’s no “best,” only “most suitable.” If your team is all technical, Bitwarden self-hosted offers the best value but has high operational costs. For out-of-the-box experience and high team adoption, 1Password Business is currently the safest bet. Budget-conscious teams can consider NordPass for good value, but be aware the missing emergency recovery feature is a real risk.

Final Thoughts

One comment on that r/sysadmin thread stuck with me: “You’ll never make everyone happy, but you can make everyone use a password manager.”

Password management, at its core, is about lowering the security barrier. Don’t chase perfection. Just get moving. Even if you start by typing all the sticky-note passwords into a shared vault, that’s infinitely better than having them stuck to a monitor.

Remember this: Recovery keys belong in a safe, not in someone’s head.

References & Community Insights

The following authoritative resources were referenced for architectural best practices and specifications:

• Hacker News (Y Combinator)
• Reddit r/sysadmin Community
• Stack Overflow Architecture