# What to fix first when your passwords live in a spreadsheet

First limit who can open the sheet. Next turn it into a list of accounts. Last move the passwords out. The account list can stay in the spreadsheet.

Updated: October 16, 2026

Keeping shared logins and passwords in a spreadsheet means one file does two jobs: it's the list of accounts and the place the passwords are stored. The settings named below are Google Sheets' own. Microsoft Excel and other tools have similar ones, under different role names and menus.

## What goes wrong with a password spreadsheet

A spreadsheet is built for passing data around. Put passwords in it, and each download, copy or printout becomes another copy of your passwords.

There are four problems.

- More people can see the passwords than you think. A file shared with "Anyone with the link" opens without signing in. And unless someone reviews the sharing list, people who left or changed roles stay on it.
- Copies pile up outside the sheet. By default, even viewers can download the file, and a downloaded copy is beyond the reach of the sheet's sharing settings.
- Nothing shows who used a password. Version history records who changed a cell, not who read a password and signed in with it.
- Removing someone doesn't undo what they saw. They lose access to the sheet, but the passwords they read and the copies they downloaded stay with them.

Google's help pages describe how this works. People you share with are viewers, commenters or editors, and the sharing table shows download as allowed by default for viewers and commenters. Version history needs edit permission, and it shows who updated the file and what changed. Files owned by a work or school account can also show view history. Even then, a record that someone opened the sheet doesn't show whether they used a password from it.

## First: limit who can open it

Start by narrowing the people who can open the sheet to those who use the passwords in it. Do this before rebuilding the list or moving passwords. Moving takes time, while a sharing change is done the same day and cuts the number of readers right away.

Google's help pages cover these four steps.

1. Under General access, choose "Restricted," so only the people you add can open the file.
2. In the sharing list, choose "Remove access" for anyone who doesn't use the passwords: people who left, people who changed roles, people added just in case.
3. In Settings, under "People who can download, copy, and print," allow only the roles that need it, so viewers and commenters can't download, copy or print it from Sheets.
4. In Settings, uncheck "Editors can change permissions and share," so editors can't add people without the owner.

These steps don't recall copies already made or files already downloaded. Google's page on limiting sharing also says you can't stop people from sharing the content in other ways. The last section deals with old copies. Move on without waiting to collect them.

## Next: turn it into an account list

Next, turn the sheet from a list of passwords into a list of accounts. Before you can choose where the passwords go, you need to know how many accounts there are, who uses each one and where its two-step verification codes go.

Use the columns from "Where to start" in [Managing shared accounts](/guides/shared-accounts). They are the service, the username, where the password is kept, who uses it, who owns it, where two-step verification codes go, and when someone last checked the row. [How to take inventory of shared accounts](/guides/shared-accounts/shared-account-inventory) has the full set. The "where the password is kept" column names a place, not the password. The password column stays until you finish moving, but each row now shows whether it has moved.

CISA's "Use Strong Passwords" page says you don't want to save passwords "in a file on a computer," and recommends a password manager instead. A spreadsheet is that kind of file. If you keep using it for a while, write down who may open it and how downloads and copies are handled.

## Last: move the passwords out

Finally, take the passwords out of the spreadsheet. There are three places to move them. One is sharing through a [password manager](/guides/shared-accounts/what-is-password-manager). Another is your identity provider (a service such as Okta or Microsoft Entra ID that signs employees in to apps) filling in the login for people. The third is an access management tool that signs people in without showing them the password. [Managing shared accounts](/guides/shared-accounts) compares what each one does and leaves.

Move the rows with the most users first. The more people use an account, the more people have read or copied its password, so moving those first removes the most exposure. For each row you move, delete the password from the sheet and fill in where it's kept now, such as "password manager, Marketing vault."

Moving a password doesn't change what people already read in the sheet. So change the account's password at the same time you move it. Then every copy made while the password sat in the sheet stops working.

Once every row has moved, the spreadsheet holds no passwords. It becomes a list of which accounts exist, who uses each one and where each password is kept. You can then decide who should see that list based on their work, and use it for regular reviews and for checks when someone leaves.


## Frequently asked questions

**Should we stop using the spreadsheet right away?**

Fixing it in order is easier than dropping it overnight. Limit who can open it, turn it into an account list, then move the passwords out. The account list can stay.

**Does version history show who used a password?**

No. It shows who changed cells, not who read a password and signed in with it. The service's own records show only the shared account's name.

**Is removing a former employee from the sharing list enough?**

They can no longer open the sheet, but they still know what they saw, and any copy they downloaded is still out there. The only fix is to change those passwords.

**Can we keep passwords in the sheet if we lock it down?**

CISA advises against keeping passwords in a file and recommends a password manager. If you keep the sheet for now, write down who may open it and how copies are handled, and plan to move the passwords out.

## Sources

- [Google Docs Editors Help: Share files from Google Drive](https://support.google.com/docs/answer/2494822?hl=en)
- [Google Docs Editors Help: Stop, limit, or change sharing](https://support.google.com/docs/answer/2494893?hl=en)
- [Google Docs Editors Help: Find what's changed in a file](https://support.google.com/docs/answer/190843?hl=en)
- [Google Docs Editors Help: View the activity on your Google Docs, Sheets & Slides](https://support.google.com/docs/answer/7378739?hl=en)
- [CISA: Use Strong Passwords](https://www.cisa.gov/secure-our-world/use-strong-passwords)

## How Junify handles this

**Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login.

**With Junify** With Junify, your admin moves each password from the sheet into Junify, and the people who use the account never see it. They verify on their own phone and click to sign in. Each use is recorded by person even though the login stays shared. What's left in the sheet is the list of which accounts exist and who uses each one.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=spreadsheet-password-management)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both.
- [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password.
- [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.