I'll address your question in two parts.
Are password the proper way to protect a data set
Shared access is actually a terrible a way to control access to a resource: they do not actually identify anyone or even verify that the access is really legitimate. This means that:
- They cannot be used for auditing.
- The only way to revoke access is to change the credentials for everyone.
- If the access is revoked, it is revoked for everyone (for instance, if anyone enters the wrong password too many time on a system that has an account lockout policy, nobody can access the system anymore).
This means that, in most cases, you should shy away from sharing passwords between team members and that this practice is usually incompatible with regulatory framework related to personal data protection (at least every one that require an audit log to be maintained).
How to store shared passwords (when you have to)
First, the obvious: don't use anything cleartext, don't use anything that does not provide a very easy way to generate strong passwords, don't use anything that implements a robust data protection in the first place. This means always use a password manager. Really, there is no excuse whatsoever not to do so.
Ideally, every user should have a personal password for every resource but, in practice, this is not always possible. Often, you will need to have access to system that do not let you handle your access accounts the way you want (create user accounts and delegate their rights yourself). You will also need some way to save passwords for shared accounts (service accounts, for instance) or encryption password for data,
In such a case, you should always use a dedicated password management product.
Offline tools (like keepass) can fit the bill but you need to be aware of the risk: once you grant access to someone, you can't easily revoke it: changing the password database access key is not enough sine everyone might have made a copy so you are left with no choice but change ALL the passwords that were stored in the DB.
If an offline database does not offer sufficient granularity, then you can fallback to a team password manager. These products usually store all password database on a central server and let administrators grant access to each individual password to a user or group of user. This can provide a good granularity for access control.
In all case, however, you need to keep in mind that once access to a shared password has been granted to someone, the ONLY way to revoke that access is to 1/ revoke access to the password storage (by changing the master password, for instance) AND changing the password itself.