# Password Manager for Bookkeepers: Setup for a Practice

- Author: AutoBankConvert (https://www.autobankconvert.com)
- Published: 2026-02-16
- Updated: 2026-02-16
- Category: Security and trust
- Canonical: https://www.autobankconvert.com/blog/password-manager-for-bookkeepers

> Set up a password manager for bookkeepers: shared vaults per client, staff access levels, and the logins that should never be shared at all.
A password manager for bookkeepers stores every client and practice login in encrypted vaults, one vault per client, so each staff member opens only the clients they work on. Pick a business plan with shared vaults, per-person permissions and an audit log, then keep personal logins and client bank passwords out of any shared vault.

## What should a password manager for bookkeepers do?

A password manager built for a bookkeeping practice has to do more than remember passwords for one person. It must let you share a login with a colleague without showing the password in a chat, take that access away later, and show who opened what. Personal plans rarely do all three.

When you compare products, check for these features:

- **Shared vaults or collections**, so logins can be grouped by client rather than by person.
- **Per-person permissions**, at least "use only", "view" and "manage".
- **An activity log** that records who viewed or changed an entry.
- **Admin recovery**, so the practice owner can regain a vault if a staff member leaves or forgets their master password.
- **A second sign-in step** on the manager itself, with an authenticator app or a hardware key.
- **A password generator** that makes long, random passwords by default.

The generator matters more than it sounds. CISA's guidance on [using strong passwords](https://www.cisa.gov/secure-our-world/use-strong-passwords) recommends at least 16 characters and a different password for every account. It also says most people cannot remember passwords like that and should use a password manager. For a bookkeeper with logins to dozens of client portals, that is the whole case for buying one.

## Client vaults in a practice password manager

A client vault is a shared folder inside the password manager that holds every login for one client: the accounting file, payroll, the client's document portal and any vendor sites you sign in to on their behalf. Grouping by client makes it easy to grant or remove a person's access to one client's books in a single step.

Add a few vaults for the practice itself. A sample layout for a three-person practice could look like this (names and assignments are examples):

| Vault | Holds | Who has access |
| --- | --- | --- |
| Practice admin | Domain, email admin, payroll for the practice, insurance portal | Owner only |
| Practice tools | Statement converter, practice management, cloud drive | Owner, all staff |
| Client: Example Bakery LLC | QuickBooks Online user, payroll portal, vendor portals | Owner, Staff A |
| Client: Example Dental Group | Xero user, merchant portal | Owner, Staff A, Staff B |
| Personal: each staff member | That person's own logins | That person only |

Name every client vault the same way you name the client's folder and the client's workspace in your other tools. When someone searches "Example Bakery", every system should agree on what that means. Add a note field to each entry with the date it was last changed and who set it up.

## Password manager access levels for bookkeeping staff

Access levels decide what each person can do with a vault entry. A preparer usually needs to use a login without seeing the password. A reviewer may need to view it. Only the owner or an admin should be able to edit, share or delete entries, so nobody can pass client logins to someone outside the practice.

A simple rule set works for most small practices:

- **Use only**: the manager fills the login in the browser, and the password stays hidden. This suits most staff and every contractor.
- **View**: the person can reveal the password. Give this only where a tool cannot be autofilled, such as a desktop program.
- **Manage**: the person can add, edit and share entries. Keep this to the owner and one deputy.

Hidden passwords are not a full barrier, since a determined user can still capture what a browser fills. They do prevent the casual habit of copying a password into a note. Pair access levels with a second sign-in step everywhere it is offered; the guide to [two factor authentication for bookkeepers](/blog/two-factor-authentication-for-bookkeepers) covers which method to choose for each kind of account. Review the vault permissions each quarter alongside the client access list from the [bookkeeping data security checklist](/blog/bookkeeping-data-security-checklist).

## Which logins stay out of a shared password vault?

Some logins should never sit in a shared vault, even a well-run one. A client's own online banking login is the main example: it belongs to the client, it often moves money, and the bank's terms usually expect only the account holder to use it. Ask for a separate user or read-only access instead.

Keep these out of shared vaults:

1. **Client bank logins that can move money.** Ask the client to add you as a separate, limited user. The post on [bookkeeper access to client bank accounts](/blog/bookkeeper-access-to-client-bank-accounts) explains the options banks commonly offer.
2. **Each person's own email and the password manager's master password.** These unlock everything else. They stay personal.
3. **Recovery codes for the practice email admin.** Store them offline, in a sealed envelope or a safe, so a stolen vault cannot also reset your email.
4. **Tax agency accounts tied to one person's identity.** Many government portals issue credentials to an individual, and sharing them breaks that link.
5. **Any login a client has not agreed to let you use.** If the engagement letter does not mention it, ask before you save it.

A common mistake is putting a client's banking password into the practice vault "just for this month" during a catch-up job. Months later it is still there, still valid, and visible to anyone added to that client. Set a reminder to delete temporary entries the day the work ends.

## Moving a bookkeeping practice into a password manager

Moving a practice into a password manager is a one-week project if you do it in a fixed order and change passwords as you go. The aim is that, at the end, no client login lives in a spreadsheet, a browser's saved passwords, a sticky note or an email draft.

A setup order that works:

1. Choose the product and create the admin account. Turn on its second sign-in step first.
2. Create the practice vaults, then one vault per client, using your existing client names.
3. Invite staff. Each person sets their own master password and second step.
4. Import or enter logins one client at a time. Change each password to a generated one as you save it.
5. Delete the old copies: browser saved passwords, spreadsheets, notes and old emails.
6. Set access levels per vault, starting from "use only".
7. Turn off password saving in staff browsers, so new logins go to the manager.
8. Book a quarterly review of vault access and stale entries.

Pick the week with care. Changing dozens of passwords just before a filing date invites a lockout at the worst moment, so check the [tax deadlines for bookkeepers](/blog/tax-deadlines-for-bookkeepers) and choose a quiet stretch. Put your statement conversion tool in the practice tools vault too. [AutoBankConvert](/) does not need clients to log in at all, so the only login to store for it is your own team's.