# Can employees keep work passwords in their personal password manager?

It's best not to. The vault belongs to the employee, so the company can't open it, collect it or confirm it's empty when they leave. Use a business plan.

Updated: October 16, 2026

If you already use a [password manager](/guides/shared-accounts/what-is-password-manager) at home, putting work logins in the same vault is tempting. One master password fills in everything, personal and work. But what your company can do about those work logins depends on whose vault they sit in.

## Who owns a personal vault

A personal plan is one the employee pays for or uses for free. For 1Password that means an individual or family account. For Bitwarden it means the Free, Premium and Families plans.

That vault belongs to the employee. 1Password's help center tells people to keep personal items in an individual or family account. It adds that none of the items in those accounts are available to their employer. Bitwarden works the same way. When someone is removed from the company's Bitwarden organization, they keep every item in their own vault.

Neither product treats an item differently because it's a work login. Only the account the item sits in matters. So a company password saved in a personal plan sits somewhere the company can't see.

## What the company can't do with a personal vault

### Collect the passwords when someone leaves

NIST SP 800-53 Rev. 5 is NIST's catalog of security controls. Federal systems must use it, and other organizations may use it voluntarily. Its personnel termination control, PS-4, calls for revoking the person's sign-in secrets when they leave. It also calls for getting back security-related company property and keeping access to the systems the person controlled. The CIS Controls ask for a set process for revoking access (safeguard 6.2).

Neither control reaches into a personal vault. You can't open it, so you can't collect the work logins or confirm they were deleted. You don't even know which services were in it, except from what the person tells you. The one step left is to change the password on each service they may have saved.

### Keep sharing inside the company

Personal products can share too. Google Password Manager saves passwords to your Google Account. Its help page says you can share a password only with members of your Google family group. The copy is saved in the other person's Google Account. If you want to stop sharing, the page tells you to change the password. Bitwarden's Families plan is for sharing between you and five friends or family members.

If a work password travels this way, the company has no way to find out. The sharing happens under the employee's own plan, not the company's.

### See who used a login

Some business plans keep a record of activity inside the vault. 1Password's usage reports, part of 1Password Business, list which items a team member used, when, and the action, such as filling or copying a password. Bitwarden's event logs, on Teams and Enterprise, record events such as viewing a password, copying it and autofilling an item. A personal plan has no company admin, so the company has no record to read.

## What a business plan changes

On a business plan, the vaults live in the company's account, and admins decide who gets each one.

| Point | Personal plan | 1Password Teams or Business | Bitwarden Teams or Enterprise |
| --- | --- | --- | --- |
| Who decides who sees a shared login | The employee | Admins by default, and anyone given permission to manage the vault | Anyone with permission to manage the collection (Bitwarden's unit of sharing) |
| The employee's own vault | The company can't open it | People with permission to recover accounts can reach it | Belongs to the employee, unless an Enterprise policy makes it company-owned |
| Activity records | None for the company | Usage reports (Business) | Event logs |

In 1Password, each person has an Employee vault. Other team members can't see it directly. But anyone with permission to recover accounts (restoring access for someone who forgot their password) can reach every item in it. Deleting a person's account wipes that vault for good, with no way back. That's why 1Password's offboarding guide says not to delete an account until the person has moved their work items to a shared vault.

In Bitwarden, an item shared with the organization belongs to the organization. It stays there after the person who shared it leaves. Items in someone's own vault stay with that person.

Bitwarden Enterprise has a policy called "Centralize organization ownership." For members who aren't owners or admins, it swaps their own vault for My Items, a space only they can open but the organization owns. When the member leaves, My Items stays with the organization, and an admin can give someone else access. The policy can also prompt members to move existing items into the organization. A member who declines loses access to the organization right away.

## What a business plan doesn't change

A business plan doesn't make anyone forget a password they've seen. 1Password's offboarding steps include changing the passwords that were shared with the person who's leaving. If that person was in the Owners or Administrators group, the guide says to assume they saw every password in the vaults they could manage.

NIST SP 800-53 asks for the same follow-up on shared logins. Control AC-2 k calls for a process to change a shared account's password when someone leaves the group. With a business plan, you know which passwords to change. You still have to change them and give the new ones to everyone who stays.

## What to put in your policy

CISA, the federal cybersecurity agency, says in its guidance for small and medium businesses that "a company-wide password manager makes it easier for employees to follow best practices." It also tells businesses to work with their IT team or provider to make these password practices a requirement for business systems. When an employee asks where work passwords go, your policy should already have the answer.

Write down three rules:

1. Company passwords go only in the vault your company pays for. Anything in a personal plan is out of the company's reach.
2. Personal passwords get their own place. 1Password Business includes a free Families membership, and the business can't see or manage that family account. Bitwarden Enterprise can sponsor a free Families plan for members.
3. Company passwords already in a personal vault get moved to the company vault and deleted from the personal one. You can't confirm the deletion, so change the password on each service that was moved.

For policy wording you can adapt, see [A password policy template and how to write each section](/guides/shared-accounts/password-policy-template).


## Frequently asked questions

**Can employees use a free password manager for work logins?**

It's better to keep company logins out of it. A free or personal plan belongs to the employee, so the company can't see what's inside, collect it when they leave or confirm the items were deleted.

**With a business plan, do we still change passwords when someone leaves?**

Yes. Removing someone from a vault doesn't erase what they saw. 1Password's offboarding steps include changing the passwords that were shared with the person who left.

**How do we keep work and personal passwords apart?**

Work logins go in the vault your company pays for. Personal logins go in a personal account. 1Password Business includes a free Families membership, and Bitwarden Enterprise can sponsor one.

**What if company passwords are already in someone's personal vault?**

Ask them to move the items to the company vault and delete them from the personal one. You can't confirm the deletion, so change the password on each service that was moved.

## Sources

- [1Password Support: About your Employee vault](https://support.1password.com/employee-vault/)
- [1Password Support: Offboard a team member](https://support.1password.com/offboarding/)
- [1Password Support: Create reports in 1Password Business](https://support.1password.com/reports/)
- [1Password Support: Create and share vaults](https://support.1password.com/create-share-vaults-teams/)
- [1Password Support: Get a free 1Password Families membership when you use 1Password Business](https://support.1password.com/link-family/)
- [Bitwarden Help Center: Password Manager plans](https://bitwarden.com/help/password-manager-plans/)
- [Bitwarden Help Center: Sponsored Families for Members](https://bitwarden.com/help/families-for-enterprise/)
- [Bitwarden Help Center: Permanently remove access](https://bitwarden.com/help/remove-users/)
- [Bitwarden Help Center: Organizations FAQs](https://bitwarden.com/help/org-faqs/)
- [Bitwarden Help Center: Enterprise policies](https://bitwarden.com/help/policies/)
- [Bitwarden Help Center: Event logs](https://bitwarden.com/help/event-logs/)
- [Google Chrome Help: Manage passwords in Chrome](https://support.google.com/chrome/answer/95606?hl=en&co=GENIE.Platform%3DDesktop)
- [CISA: Require Strong Passwords (small and medium businesses)](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-strong-passwords)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AC-2, PS-4)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
- [CIS Controls Assessment Specification for Controls v8.1: CIS Control 6, Access Control Management](https://cas.docs.cisecurity.org/en/latest/source/Controls6/)

## How Junify handles this

**Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login.

**With Junify** With Junify, you stop guessing which shared passwords an employee may have copied into a personal vault. Change the password when you add the account to Junify. Your admin keeps it, and people verify on their own phone and click to sign in without seeing it. A password they never saw can't end up in their personal vault. When someone leaves, remove their access in Junify.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=personal-password-manager-at-work)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both.
- [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password.
- [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.