What is a password manager?

A password manager is software that keeps your usernames and passwords in an encrypted vault and fills them in on sign-in pages.

What does a password manager do?

Logins go into a vault, an encrypted store that opens only for the people it belongs to. In 1Password, for example, everything in an account is end-to-end encrypted, and it’s protected by your account password combined with a Secret Key. Once the vault is open, a browser extension (a small add-on to your browser) or an app fills in the username and password on the sign-in page. NIST’s digital identity guidelines expect services to accept this. SP 800-63B-4 says verifiers, the services that check your password, “SHALL allow the use of password managers and autofill functionality” (section 3.1.1.2).

What does sharing allow?

Business plans let several people share a vault, or in Bitwarden a collection (Bitwarden’s unit of sharing). In 1Password Teams, access to a shared vault comes in three levels: viewing, editing and managing. Bitwarden sets one of five permissions per collection: view items, view items with hidden passwords, edit items, edit items with hidden passwords, and manage collection. With a shared vault, nobody needs to send passwords by email or chat.

Does the person you share with learn the password?

If they can view it, yes. In 1Password Teams, viewing includes showing concealed passwords and copying them to the clipboard. Bitwarden can hide passwords, but its help center says users “may still use passwords via autofill.” Hiding makes copy-and-paste harder without fully blocking access. Bitwarden’s advice is to treat a hidden password like any other shared login.

Whose name do the records show?

The service’s own records show the shared account’s name. The password manager’s part ends at the sign-in page, so the service can’t tell who used autofill. Some business plans keep records inside the vault. 1Password’s usage report, part of 1Password Business, shows which items a team member used and when each was last used. Bitwarden’s event logs, on Teams and Enterprise plans, record events such as viewing a password and autofilling an item.

What happens when someone leaves?

Remove the person from the vault or collection, and they can no longer open it. Bitwarden offers two options: revoking access for now, or removing it for good. But removal doesn’t erase a password the person saw or wrote down. If they did, they can still sign in until someone changes it on the service itself. So each departure still means a new password and an updated vault item.