To my understanding, password-protected spreadsheets are not best practice for storing admin creds, whether it's a company of 5 people or a company of 50,000 people. In such a case, what are some best practices for storing admin account credentials?

My two cents: An obvious answer might be encrypt the data and store it in a db. My response to that is say there's a data breach, the db is compromised, maybe the nefarious user(s) grab a copy of your db, deletes the db, and now your admin creds are all gone and you cannot access any systems because you don't know the admin credentials. Maybe storing it n the db is a good move to help ensure the data is encrypted and in one centralized location, but you're still vulnerable if an attack is successful.

There's two-factor authentication and store the data with a third-party but does it make sense to store company sensitive admin credentials with a third-party?

So, I go back to password-protected files or spreadsheets. If only a limited number of people within an organization need to know the admin creds, does it make more sense to store it in a spreadsheet or file, password protect it with AES 256-bit encryption using a very strong password (longer the better), and securely pass the file around to those who need it and update the passwords on a frequent basis? The file would be stored on the local machine of each user who are privy to the information. And maybe break out the creds into several files and each file has a different password to open it.

I'm very curious to hear what others in the community would recommend.

  • 1
    Why are you sharing passwords instead of having multiple users as administrators? Each of them can have their own logins and you can even have an audit trail this way.
    – Limit
    Aug 10, 2020 at 23:30
  • That would be a great idea, actually. The problem at hand is I'm not talking about one system. I'm talking about several different systems. Let's say 100 internal and external applications and each app has their own creds. Each of those apps have different requirements for how admins are setup. Some apps require an admin user, in addition to users with admin role. I have to take that into account. Unfortunately, it's not that simple. That is a good idea, though. I may have to re-investigate each app to see if the admin user can be eliminated. Aug 11, 2020 at 17:03
  • Also, while you are at it, it would be a good idea to check if those systems support single sign on. That can help as well
    – Limit
    Aug 12, 2020 at 18:28

1 Answer 1


I'd rather have a password manager with 2 factor auth. You're quite right, in that it's a target, and it's got to be one of your #1s in any kind of DR scenario. I think the advantages of one source of truth, secure password sharing, true random password generation, and granulated access control are worth the hassle of having another system to make highly available, etc.

There's so many disadvantages with using multiple copies of anything, so many ways it's open to abuse and human error...even within a small team.

  • Yes, that's the problem with multiple copies, instead of one centralized location. Would you use a password manager with 2-auth on a company domain or third-party? If it's hosted internally and that system gets breached, maybe the hackers can't decrypt the data but they can delete it and then I'm in a real pickle with no way to get into any apps which require an admin user (as opposed to users with admin roles). What can take hours to get in may take days or weeks on the phone with various vendors. It's a nightmare scenario if we lose those creds. Aug 11, 2020 at 17:09
  • 1
    If I was standing something like this up in the cloud, I'd want access whitelisted to my IP address/es. Way round might be to do that but also include IP addresses of a trusted third party as a break-glass type thing, if your whole network got really borked. On prem, it's ultimately going to come down to your backups / backup infrastructure...
    – D0gfather
    Aug 11, 2020 at 19:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .