A spreadsheet full of shared logins fails one row at a time. A phishing email that slips through fails all forty of your marketing tools in the same afternoon, and that gap is the entire argument for taking password security seriously inside a SaaS-heavy marketing ops team. Mine got made for me by a HubSpot support email that turned out to be near-flawless typosquatting: one letter swapped in the domain, nothing else different, and a login button I very nearly clicked without checking.
Four years of testing password managers for a marketing team has convinced me that login hygiene has less to do with which app you pick and more to do with closing off every lazy shortcut people build around it. Phishing is the headline risk, sure, but the spreadsheet, the Slack message, the browser autofill left on by default: those are the quiet failure points that make a single good phishing email so expensive.
The Spreadsheet Fight I Kept Losing to Davon
Davon Kearney runs IT at our office, and for the better part of two years he was the one defending our shared login sheet, arguing that a restricted folder was protection enough. The turning point wasn't the phishing scare: it was a vendor security audit that flagged the spreadsheet by name, and watching him come around to a real vault did more for team buy-in than anything I'd said on my own for months.
Before the vault, my fallback for handing off a login was a Slack DM typed from a table at Fareground food hall downtown, delete after reading at the top, as if that note carried any actual authority. It didn't stop anyone from screenshotting the message, and it left a plaintext password sitting in a channel's search index for anyone with access to dig up later. That habit is the first thing I'd point to if someone asked what not to do.
My actual setup lives in the second bedroom, which stopped being a guest room years ago and turned into a standing-desk test bench: a personal laptop on one side, a refurbished machine kept strictly for vault trials on the other, plus a second phone propped up running whatever authenticator app I'm currently torturing. Checking two vault dashboards side by side around noon still gives me a very specific kind of screen-glare headache I haven't solved.
Locking Down the Login Itself
Every vault worth trusting runs on zero-knowledge architecture, meaning the company hosting it never actually sees your master password, and I stopped taking a provider seriously the moment I found one cutting corners on it. Everything stored also needs to sit behind AES-256 encryption at rest, which by now is table stakes across every serious vault, not a feature worth charging extra for. I've gone deeper on what that encryption actually buys you in the piece about how I finally rebuilt my digital security after a near-miss, so I won't repeat the whole argument here.
None of that matters if the master password holding it together is weak, so I treat mine as the one credential I'm never allowed to get lazy about. A few vaults also pair that master password with a separate secret key stored apart from it entirely, which means a leaked master password by itself still isn't enough to get in.
Two-Factor Was Never the Whole Answer
Standard multi-factor authentication, the code you punch in after your password, still belongs in the stack, but it's a floor, not a ceiling. Wherever a tool supports it, I've pushed our team toward passkey logins instead, since a passkey is tied to the physical device sitting in your hand and can't be typed into a fake login page the way a code can.
Password Security for Freelancers and One-Off Logins
When a freelancer comes on for a short campaign, I share a permissioned vault folder instead of a password, and I cut that access the day the contract ends, no separate cleanup step required. For the one-off cases, like a vendor who needs a single login once and never again, a one-time secure link beats a Slack message every time, since it expires whether anyone remembers to revoke it or not.
A reader named Mira, who runs a solo consultancy out of Chicago and messages me every so often after finding the site through a Reddit thread, still argues that I'm too hard on Dashlane's per-seat pricing for teams her size. It's about the only thing the two of us disagree on.
What Travel, Turnover, and a Dead Laptop Have in Common
I found out the hard way in a hotel room in Boston that travel mode only works if you remember to switch it back off: I'd hidden a handful of vaults before the flight, forgot about it once I landed, and stood there blinking at an empty list until it clicked and every hidden vault reappeared at once. Every provider should also hand you some kind of emergency kit for the day your laptop gets run over by a bus, and mine sits printed in a drawer, not saved as a file anywhere near the machine it's meant to replace.
Vault portability matters more than people expect, too: before I trust a provider with forty logins, I check how easily I could pull every one of them back out if I ever needed to switch, because a vault that won't let go is its own kind of trap dressed up as loyalty. Most of these tools also watch the open web for your logins turning up in a breach dump, and I've learned to actually act on those alerts the day they arrive instead of snoozing them. A handful will generate a throwaway email alias for every new SaaS signup as well, which has quietly cut down on how much spam reaches my real inbox, and the form-filling side matters more than I expected too, since a good chunk of any given week is signup forms for whatever new martech tool is on trial.
Why the Browser Tab Isn't a Password Manager
If you're still leaning on your browser's built-in saver for work accounts, that's worth reconsidering. I've written separately about why your browser password manager is not secure enough for work, and the short version is that it keeps too much sitting in one place with too little standing between it and anyone at your keyboard.
The One Rule That Actually Stuck
One test has mattered more than any feature comparison across four years of doing this: does a tool make the secure option the easy option for the person actually using it, not just the administrator who configured it. A vault nobody complains about gets used correctly, and a vault everyone finds annoying turns into Post-it notes and Slack DMs within a month, no matter how good the encryption underneath it is.
Our team is out of the spreadsheet entirely now, with every API key and SEO tool credential living somewhere built for this instead of bolted onto a shared folder. Davon still brings up that old vendor login sheet occasionally, mostly to remind me how bad it used to be, and the actual proof this worked isn't a feeling of confidence: it's that Slack has stopped being anyone's password delivery system on my team.