Password Managers for Accounting Practices

For a sole practitioner, Bitwarden Free is a useful password manager across devices. Teams need a business vault with individual staff access. Bitwarden Teams suits shared collections and event logs. Enterprise adds administrator recovery. Keeper suits practices needing detailed shared-folder permissions.

Choose a Password Manager for Your Practice

A practice password manager stores permitted credentials in an encrypted vault and fills them into sign-in fields. Each staff member unlocks their own vault account. Sharing an approved item gives them access to that item without handing over the principal’s vault password.

Vault access, multi-factor authentication and permission to use an account are separate questions. A saved password does not grant authority over the service. Multi-factor authentication (MFA) adds another sign-in requirement, such as a security device or authenticator approval. Use it on the vault and the underlying service where available.

The Australian Signals Directorate recommends strong, unique passwords and MFA in its cyber guidance for business leaders. A vault helps staff follow that advice without memorising a different password for every service.

Managed Business Vaults

Choose a business plan when several staff need permitted shared credentials and someone must remove access when they leave. The following distinctions concern the business offerings. Personal accounts with the same product names do not automatically have their administration features.

Product	Staff Access and Sharing	Recovery and Departure	Access History and Export
Bitwarden	Individual accounts share practice-owned collections. Teams has group sharing. Enterprise adds policy administration.	Enterprise account recovery requires enrolment. Teams relies on the member’s own recovery arrangements.	Teams and Enterprise have event logs. Authorised collection managers or administrators can export organisation items, including encrypted JSON.
Keeper	Named users share records or folders, with permissions for viewing and editing. Roles govern administration.	Recovery phrases support account recovery. Configured business account transfer helps retain a departing employee’s records.	Reporting and audit features depend on the business package. Users can export accessible vault data, subject to policy.
NordPass	Business users have individual vaults, groups and shared-item permissions. Sharing Hub administers shared credentials.	An organisation owner can approve business account recovery. Item transfer supports departure handling.	Activity Log records business activity. CSV item export is available, subject to the organisation’s exporting policy.
Proton Pass	Business users share vaults with viewer, editor or administrator permissions. Organisation settings can restrict external sharing.	Recovery of an account and recovery of its encrypted data are separate. Set the appropriate recovery method before access is lost.	Usage logs require Pass Professional or an eligible Workspace plan. Export through the web, extension or Windows app includes an encrypted-file option.
LastPass	Business accounts have individual vaults and shared folders with group permissions.	Administrator recovery needs its recovery policy and account prerequisites set up. Removing a user and retaining shared work are separate actions.	Business administration includes reports. Vault export is available through supported export tools, subject to administrator policy.

Bitwarden documents unlimited passwords and devices on its individual free plan. Its free organisation shares with one other user through two collections. That can suit a very small arrangement, but it does not supply Teams event logs or Enterprise recovery. Choose Enterprise when administrator recovery is a requirement, even if the practice has few staff.

Keeper’s documented roles and shared folders suit a practice that needs separate access for administration and client-service staff. Keeper’s security documentation distinguishes recovery from account transfer. Configure transfer before a leaver’s account becomes unavailable. Do not assume that giving someone an administrator title lets them decrypt every vault.

NordPass Business is a useful alternative when the principal wants an owner-approved recovery route and central oversight of sharing. Its exporting policy governs whether staff can download items. A CSV export is readable outside the vault, so restrict it to an authorised migration or backup task.

Proton Pass Professional suits a practice already using Proton business accounts and wanting shared vaults with usage logs. Its recovery documentation separates restoring sign-in from decrypting existing data. For non-private organisation users, the organisation’s administration arrangements govern recovery. A personal recovery email alone is not the whole recovery plan.

LastPass Business suits a practice that already administers its shared folders and account policies. Its free personal offering restricts use to one device type. Keep business permissions and recovery settings in the decision, even when staff already know the personal product.

These hosted products have mobile apps and desktop browser access. Bitwarden and Proton also document desktop apps for Windows, macOS and Linux. NordPass documents those desktop systems plus iOS and Android. Keeper and LastPass support mobile use and major desktop browsers. Choose against the devices your staff actually use, including browser extension restrictions on managed computers.

Browser and Device Vaults

Browser vaults can suit a sole practitioner’s individual accounts. Synchronising a principal’s browser account onto every employee’s device makes that account the shared access point. It also mixes departure handling with the principal’s personal recovery arrangements.

Vault or Service	Where Credentials Live and Fill	Practice Decision
Google Password Manager in Chrome	Google-account credentials synchronise through supported Chrome and mobile use. Device authentication protects access.	Useful for an individual. Google-account ownership and recovery must remain separate from practice-wide credential sharing.
Firefox	Saved logins live in the browser profile. Mozilla account sync carries them between devices.	Set a Primary Password for local protection. It is local to each profile or device and does not replace named team permissions.
Opera and Opera GX	Opera account sync supports passwords between desktop and Android.	Treat the browser account and any sync passphrase as individual recovery dependencies. A shared profile is a poor substitute for staff access.
Safari and Apple Passwords	Apple Passwords and iCloud Keychain supply autofill in the Apple environment. iCloud Passwords also supports Windows.	Shared groups have owners and members. Removing a member cannot erase a password they already saw.
Microsoft Password Manager in Edge	Microsoft documents password access through Edge personal-account profiles. Work or school administrators can restrict features.	A Microsoft 365 subscription does not itself establish shared-vault administration. Authenticator’s discontinued password autofill is not the current rollout route.
Samsung Pass in Samsung Wallet	Supported Samsung devices use biometric sign-in and Samsung-account synchronisation.	Convenient for a staff member’s compatible device. Device convenience does not establish practice-owned folders or a leaver recovery procedure.

Google Password Manager works on an iPhone through Google’s apps. Google’s iPhone instructions put Chrome and Google under the device’s autofill settings after account sign-in. Chrome also fills saved credentials in other iPhone apps. A shortcut or widget changes how quickly someone reaches their passwords. Shared-practice permissions still need a managed arrangement.

For a mixed Windows, Android and iPhone practice, a standalone business vault keeps the sharing model consistent across those devices. For one practitioner using Apple devices, Apple Passwords can be a practical individual choice. Store practice credentials under an account the practitioner can recover, with a separate continuity arrangement.

Antivirus-Branded Vaults

An antivirus subscription and a team password manager solve different jobs. Read the vault’s own offering before treating the bundled password feature as your practice’s staff-access system.

Candidate	Current Position	Migration and Team Implication
Norton Password Manager	Norton’s Australian page lists a free encrypted online vault, browser extensions and mobile apps.	A personal cloud vault can suit one user. The consumer page describes individual access, rather than the business administration compared above.
Trend Micro Password Manager	Trend Micro says the service has ended and identifies ID Protection as its replacement.	Start from a retained export or the replacement service’s supported recovery route. Do not prescribe an export from an app that is no longer available.
Bitdefender Password Manager	Bitdefender says the old product is discontinued and SecurePass replaces it.	SecurePass has extensions and mobile apps, with sharing and import tools. Use a retained export for migration after the old service closes.
Kaspersky Password Manager	Kaspersky’s Australian site lists a personal password manager with device synchronisation. Its free version limits total entries.	Import and backup support help individual migration. A consumer vault is a different purchase from a named-user business plan with administrative recovery.

Norton and Kaspersky have Australian product pages. Bitdefender’s SecurePass migration guide identifies supported browser and mobile installations. Keep the discontinued product names out of a new rollout, even if an old subscription or staff browser still displays them.

Open-Source and Offline Choices

Open-source software and self-hosting are different choices. KeePass has GPL-licensed editions and an encrypted database you can keep locally. KeePass 2 supports shared database editing and export. Everyone who can open a shared database can retain its contents, so a common database password does not give you individual staff revocation.

Bitwarden publishes source under GPL and commercial licensing arrangements. It documents a self-hosted server option, with licence requirements for paid organisation features. Self-hosting puts server updates and backups with the practice or its IT provider. It does not remove account-recovery prerequisites or the need to replace exposed shared passwords.

Proton Pass publishes open-source client apps, but its business offering is a hosted service. Choose its documented hosted account and recovery model. Publishing client source does not turn a service into a self-hosted practice server.

Choose KeePass for an individual offline vault when you can maintain protected database backups and the material needed to unlock them. Choose a hosted business vault for routine team administration. Use self-hosted Bitwarden only when a named maintainer and a replacement maintainer can recover the service.

Australian Billing and Support

Australian suitability depends on the business plan and support contract, as well as whether an app installs locally. Bitwarden documents monthly or annual business billing per user. NordPass separates business packages by features and seat requirements. Keeper and Proton have business support arrangements, while LastPass describes global support for Business customers.

Build the purchase around the required recovery and reporting features. Record the invoice currency, GST treatment, renewal basis and minimum seat commitment in the practice’s purchasing file. For an overseas invoice, include the currency-conversion cost in your internal budget. A consumer Australian checkout does not prove that a business package has local phone support.

Put the support contact and escalation path in the recovery instructions. A password reset email arriving outside Australian business hours must still reach an authorised person. Apply the same access rules alongside the other services in your accounting practice tech stack.

Separate Staff Access From Client Credentials

Give staff their own sign-in wherever the service supports it. Store a permitted shared service credential only when the provider allows sharing and individual access cannot perform the job.

Account or Information	Correct Access	Incorrect Access
Practice tax software	A staff account with the permissions needed for their assigned work	Everyone signs in as the principal
Practice-owned service with permitted shared access	A practice-owned vault item limited to the responsible staff group	A password sent to the whole team by email
Government services	The staff member’s own digital identity and the appropriate business authorisation	A client’s myGov or myID credential in a shared vault
Client form and TFN	The assigned staff account and the permitted reveal action	A client password treated as evidence of authority

myID’s terms prohibit disclosing its passwords or allowing someone else to use the credential. Staff use their own identity. Relationship Authorisation Manager (RAM) supplies the relevant business authorisation. Follow the authorised myID access arrangements instead of borrowing a client’s government sign-in.

Possession of a client password proves neither identity nor authority to act. A client’s signed engagement letter and the ATO’s agent-access arrangements have their own jobs. Use the ATO’s agent nomination guidance where nomination applies.

Write the permission map before inviting staff. An administration staff member can need access to client forms without needing every TFN or tax-software administrator permission. A tax manager can need assigned client records without needing the vault’s exporting permission. The vault group and the service role must both match the work.

Set Up the Practice Vault

Roll out the vault in account order, with a checked result before removing the old storage method.

1. Inventory the practice’s accounts. Record the service owner, existing sign-in method, authorised staff and recovery contact. The result is a list separating individual accounts from permitted shared credentials.
2. Create the practice organisation and appoint responsible administrators. Keep the billing account and recovery contact under practice ownership. A second responsible administrator must have the access needed for continuity.
3. Invite staff individually. Allocate groups or collections by role. Each person must see only the permitted practice items, with personal accounts outside those shared groups.
4. Configure MFA and recovery. Enrol business recovery where the plan requires it. Keep emergency recovery material outside the vault it unlocks, accessible only to the named responsible staff.
5. Import permitted credentials through the provider’s supported format. Compare the imported entries with the inventory. Check website addresses, attachments and passkeys separately because export formats carry different fields.
6. Replace reused passwords at the underlying services. Update the vault item after the service accepts the change. Confirm that permitted staff can sign in and that unrelated accounts retain different passwords.
7. Turn off the old browser’s password-saving and autofill features after checking migration. Use the new vault on the staff member’s actual browser and phone. Remove obsolete practice copies through your approved device procedure.

Treat export files as credentials. Prefer a supported encrypted backup. Keep a plain CSV inside a protected migration location, restrict access and remove it when the checked migration ends. Do not email it to staff or retain it in the ordinary client-document folder.

Google Password Manager’s PIN protects access to its passkeys on supported devices. Google documents reset through a non-Android device where those passkeys were previously used. Confirm that prerequisite while the device is available. Resetting all passkeys deletes them and requires setting them up again at the underlying services.

For a Bitwarden Android rollout, install the official app and choose it as the autofill service. Enable the documented Chrome integration and select the third-party autofill service in Chrome. Bitwarden documents different autofill handling in Edge, Opera and Samsung Internet. Use a trusted test page and verify its address before filling credentials.

Run the phone check with a fictional login. Confirm that the permitted item fills on the intended site, that the locked vault requires unlocking and that an unrelated staff role cannot see the item. Then perform the documented recovery exercise on a test account. Keep the results in the practice’s wider cyber security plan.

Check Sharing and Staff Departure

A starter and leaver check must cover the vault and the underlying services. Removing vault access stops future retrieval through that account. It cannot make a password someone copied disappear.

In this fictional example, a practice appoints an administration staff member. The principal invites the employee under their individual work address. The administration collection contains a permitted booking-service credential. The tax-software account has its own limited role, and client forms use individual staff access.

The starter must reach the booking service and assigned forms. The employee must be unable to open the administrator collection or unassigned client records. Record those expected results before testing. Correct an overly broad group before adding live credentials.

When the employee leaves, transfer any practice-owned items held in their vault. Revoke their vault membership and service accounts. Remove business authorisations through the relevant government arrangement. Review active sessions and devices through each service’s departure procedure.

Replace every shared secret the employee could retain, including recovery codes they could view. Update the permitted staff’s vault items after changing the service password. Removing the employee from a folder alone leaves any remembered or exported password usable until the underlying service stops accepting it.

Run a separate recovery exercise with a fictional account. Have the authorised backup administrator follow the recorded procedure while the usual administrator is unavailable. Confirm access to the test item and record the recovery event without recording the password. If the procedure needs a device, recovery file or enrolled account, put that dependency in the restricted instructions.

For a self-hosted vault, the exercise also needs a restored service backup and access to the hosting administration. The replacement maintainer must be able to complete the recovery without the departing maintainer’s personal account. An encrypted backup that nobody can unlock does not preserve practice access.

Keep Client Forms Behind Staff Sign-In

Keep client forms in the client-information system and credentials in the password manager. Tax Genie masks each TFN until an authorised staff member reveals it and logs every reveal. Individual staff sign-in lets that record identify the person who viewed the TFN.

A shared staff account would make several people appear under one identity in the reveal history. Assign each employee their own access and restrict who can reveal TFNs. When a role changes or someone leaves, remove their client-form access as well as their vault access.

A TFN is client information, not a password to put in a shared vault. A signed authority and a completed identity check are records with different purposes. Keep them with the client’s records under the access rules for that work.

Give your chosen vault a practice owner, a tested recovery route and a documented departure checklist. Keep the client-form permission map beside that checklist so removing a staff member’s access covers both systems.