Can employees keep work passwords in their personal password manager?

If you already use a password manager at home, putting work logins in the same vault is tempting. One master password fills in everything, personal and work. But what your company can do about those work logins depends on whose vault they sit in.

Who owns a personal vault

A personal plan is one the employee pays for or uses for free. For 1Password that means an individual or family account. For Bitwarden it means the Free, Premium and Families plans.

That vault belongs to the employee. 1Password’s help center tells people to keep personal items in an individual or family account. It adds that none of the items in those accounts are available to their employer. Bitwarden works the same way. When someone is removed from the company’s Bitwarden organization, they keep every item in their own vault.

Neither product treats an item differently because it’s a work login. Only the account the item sits in matters. So a company password saved in a personal plan sits somewhere the company can’t see.

What the company can’t do with a personal vault

Collect the passwords when someone leaves

NIST SP 800-53 Rev. 5 is NIST’s catalog of security controls. Federal systems must use it, and other organizations may use it voluntarily. Its personnel termination control, PS-4, calls for revoking the person’s sign-in secrets when they leave. It also calls for getting back security-related company property and keeping access to the systems the person controlled. The CIS Controls ask for a set process for revoking access (safeguard 6.2).

Neither control reaches into a personal vault. You can’t open it, so you can’t collect the work logins or confirm they were deleted. You don’t even know which services were in it, except from what the person tells you. The one step left is to change the password on each service they may have saved.

Keep sharing inside the company

Personal products can share too. Google Password Manager saves passwords to your Google Account. Its help page says you can share a password only with members of your Google family group. The copy is saved in the other person’s Google Account. If you want to stop sharing, the page tells you to change the password. Bitwarden’s Families plan is for sharing between you and five friends or family members.

If a work password travels this way, the company has no way to find out. The sharing happens under the employee’s own plan, not the company’s.

See who used a login

Some business plans keep a record of activity inside the vault. 1Password’s usage reports, part of 1Password Business, list which items a team member used, when, and the action, such as filling or copying a password. Bitwarden’s event logs, on Teams and Enterprise, record events such as viewing a password, copying it and autofilling an item. A personal plan has no company admin, so the company has no record to read.

What a business plan changes

On a business plan, the vaults live in the company’s account, and admins decide who gets each one.

In 1Password, each person has an Employee vault. Other team members can’t see it directly. But anyone with permission to recover accounts (restoring access for someone who forgot their password) can reach every item in it. Deleting a person’s account wipes that vault for good, with no way back. That’s why 1Password’s offboarding guide says not to delete an account until the person has moved their work items to a shared vault.

In Bitwarden, an item shared with the organization belongs to the organization. It stays there after the person who shared it leaves. Items in someone’s own vault stay with that person.

Bitwarden Enterprise has a policy called “Centralize organization ownership.” For members who aren’t owners or admins, it swaps their own vault for My Items, a space only they can open but the organization owns. When the member leaves, My Items stays with the organization, and an admin can give someone else access. The policy can also prompt members to move existing items into the organization. A member who declines loses access to the organization right away.

What a business plan doesn’t change

A business plan doesn’t make anyone forget a password they’ve seen. 1Password’s offboarding steps include changing the passwords that were shared with the person who’s leaving. If that person was in the Owners or Administrators group, the guide says to assume they saw every password in the vaults they could manage.

NIST SP 800-53 asks for the same follow-up on shared logins. Control AC-2 k calls for a process to change a shared account’s password when someone leaves the group. With a business plan, you know which passwords to change. You still have to change them and give the new ones to everyone who stays.

What to put in your policy

CISA, the federal cybersecurity agency, says in its guidance for small and medium businesses that “a company-wide password manager makes it easier for employees to follow best practices.” It also tells businesses to work with their IT team or provider to make these password practices a requirement for business systems. When an employee asks where work passwords go, your policy should already have the answer.

Write down three rules:

1. Company passwords go only in the vault your company pays for. Anything in a personal plan is out of the company’s reach.
2. Personal passwords get their own place. 1Password Business includes a free Families membership, and the business can’t see or manage that family account. Bitwarden Enterprise can sponsor a free Families plan for members.
3. Company passwords already in a personal vault get moved to the company vault and deleted from the personal one. You can’t confirm the deletion, so change the password on each service that was moved.

For policy wording you can adapt, see A password policy template and how to write each section.