Setting up your password manager

Last updated: July 19, 2026

Why we do this

Most break-ins are not hacking — they are someone logging in with a stolen or reused password. A password manager means every account gets a long, unique password you never have to remember, and shared logins stop living in spreadsheets and sticky notes. This is the single highest-value security change most businesses can make.

Rollout steps

• You receive an invitation email from the password manager, sent as part of onboarding. It will come from the vendor’s official domain — if you are unsure it is real, ask us before clicking.
• Create your account and set your master passphrase (see below). This is the one password you will still have to remember.
• Install the browser extension on your work computer — this is where you will use it 95% of the time.
• Install the mobile app and sign in, so passwords are available away from your desk.
• Import or add your existing work logins. The browser extension can capture them as you log in over the first week.
• Enroll in multi-factor authentication on the password manager itself.

Your master passphrase

Make it a phrase, not a word: four or five random words with a number or symbol is strong and memorable. It must be unique — never used anywhere else, ever. Do not write it on a note near your desk. If you must keep a physical copy, seal it somewhere genuinely secure, and tell no one.

Sharing passwords the right way

• Shared team logins live in shared vaults (sometimes called collections), scoped by team — the front office does not see the finance vault.
• To give someone access, share the vault entry. Never paste a password into email, text, or chat — those copies live forever.
• When someone leaves, we remove their vault access and rotate the shared passwords they could see. That only works if the passwords were actually in the vault.
• Need a new shared vault or a change in who sees what? Open a ticket in the HelpDesk portal.

MFA enrollment

Multi-factor authentication (MFA) adds a second proof that you are you — usually a prompt or code on your phone. We enforce it on email, the password manager, and any system that supports it. Use an authenticator app rather than text messages where possible; codes over text can be intercepted. Enrollment takes about five minutes per account, and we will walk anyone through it who wants help.

Do

• Let the password manager generate every new password — long and random, no exceptions.
• Use it for every work account, including the small ones nobody thinks about.
• Tell us immediately if you think your master passphrase was exposed.

Do not

• Do not reuse your master passphrase anywhere else.
• Do not keep a parallel password list in a spreadsheet, notebook, or browser’s built-in save feature — one source of truth.
• Do not share your personal vault login with anyone, including coworkers and including us. We will never ask for it.

Locked out?

If you forget your master passphrase or lose your phone, open a ticket or call us at (931) 355-7256. Business accounts have an admin-assisted recovery path, so a forgotten passphrase is an inconvenience, not a catastrophe — but recovery involves identity checks, so expect us to verify it is really you.