I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is the best practice password policy to use in this situation? The policy needs to accommodate many accounts on other sites (say, more than a dozen), as well as how the passwords are shared among team members (and changed if members leave).

Edit: To response to this.josh's comment, as I mentioned, more than 10 third-party accounts. Most of the accounts are standard password-protected accounts where there must be one for the whole team (these are services associated with the website as a whole, like the Amazon Affiliates program or reCAPTCHA). The services provided vary, few are critical, but they are still important to protect.

  • How many third party accounts do you have? What type of account controls do the third parties provide? Are you only allowed one account per third party website/service? What capabilites do these accounts provide: functions critical to your website, ancillary to your website, data backup, databasse services?
    – this.josh
    Jul 20, 2011 at 23:11
  • If you want to give access to specific people to specific passwords and keep track who has access to what I'm afraid there are no free solutions. There are few enterprise password managers: Hitachi: hitachi-id.com/password-manager or Passwordstate: clickstudios.com.au Jul 21, 2011 at 8:53
  • As Hubert Kario mentioned, Passwordstate by Click Studios will provide the functionality you're after and it is FREE for up to 5 user accounts, with no time limits.
    – user3576
    Jul 24, 2011 at 8:28
  • Hi @Mark, welcome to the site! Please see the FAQ wrt disclosing your affiliation with a product. Aside from that, answers are intended to answer the question, please see How to Answer. Hope you stick around and share some more info!
    – AviD
    Jul 24, 2011 at 8:44
  • @jrdioko, can I assume you were not asking for a list of products, but rather how to form a relevant policy? If so can you please edit the question to emphasize that, as all 4 answers so far have done just that. If it is what you wanted, this should be community-wiki (any moderator can do this), as that would be a "shopping question".
    – AviD
    Jul 24, 2011 at 8:46

6 Answers 6


I would highly recommend using a variant of KeePass. I use KeePassX, it will allow you to keep a local repository of all of your passwords and sensitive information encrypted and accessible to all of your team members.

I have been using KeePassX at work for about a year now and have had no complaints.

  • 1
    I just looked at KeepassX and some things look a little outdated, is it still under active development?
    – jrdioko
    Jul 21, 2011 at 5:12
  • 1
    Yes, it is actively under development. The software is on its way to its second major release, here. Jul 21, 2011 at 6:02
  • 4
    KeePass works poorly in a multi-user setting, since only one person can add or edit passwords at a time. Aug 23, 2011 at 8:08

I suggest Secret Server. Auditing is built in. It will also remember when the password was changed last, and it will remind you when a preset time is up (I.E 30 days) Also you can use roles to choose who has access to certain passwords.

  • 1
    The auditing functionality is essential (IMO)
    – Rory Alsop
    Jul 22, 2011 at 7:38

Meldium recently popped up on my radar. One unique thing is that they can automatically provision a new user when you onboard a new employee giving him/her access to all that they need.


I'm a big fan of CommonKey. They allow you to group users into teams and share accounts. I think it's free for up to a handful of sharing too.


I have to revise my comment. There are solutions for password management and sharing: Passpack for small groups it's cheap (4$ a month).

Unfortunately it doesn't provide auditing and doesn't remember when the password was last set.

  • Your website is currently down. Does the product even still exist? Mar 9, 2017 at 19:34

We had exactly the same issue, and decided to build Pocketvau.lt. This had been a pain point for us for quite a few years and existing solutions just didn't solve the issue in a way that we were comfortable with.

(Full disclosure: I'm the founder)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .