Password managers are mainstream, but password practices still fail

At a glance

What this is: This survey shows password managers are mainstream, but weak password handling persists through document-based storage, pen-and-paper workarounds, and widespread password reuse.

Why it matters: It matters because IAM teams still have to close the gap between tool adoption and actual credential hygiene across human, workload, and delegated access practices.

By the numbers:

• Password managers are now used by 86% of organisations, according to Bitwarden.
• Bitwarden says 53% still rely on computer documents to manage passwords.
• Bitwarden reports that 29% still use pen and paper for password management.
• Bitwarden found that 92% of respondents still reuse passwords across multiple sites.

Context

Password management is a human IAM control problem, not just a tooling problem. When organisations allow passwords to persist in documents, notebooks, and ad hoc sharing channels, they weaken the basic assumptions behind authentication, user accountability, and access review.

This survey focuses on IT decision makers and shows the gap between formal security policy and everyday practice. The main issue is not whether password managers exist, but whether organisations have standardised use, removed informal storage, and reduced password reuse across the workforce.

Key questions

Q: What is the biggest password security failure when organisations already use a password manager?

A: The biggest failure is assuming the tool fixes behaviour on its own. If users still reuse passwords, keep them in documents, or share them through email and chat, the organisation still has unmanaged credential exposure. The control problem is governance and adoption, not just procurement.

Q: Why do employees still create password risk after a company rolls out password management tools?

A: Employees usually keep using familiar workarounds when the approved process feels slower or harder than the informal one. If rollout support is weak, people revert to documents, paper, or messaging apps. The organisation then gains a tool without changing the underlying credential behaviour.

Q: How can organisations tell whether password governance is working?

A: They should measure ticket reduction, reset completion time, audit trail quality, and whether emergency recovery works across all connected identity systems. A good programme shortens recovery without creating uncontrolled privilege, inconsistent policy enforcement, or gaps in post-incident review.

Q: Should organisations require the same password manager everywhere?

A: Yes, when the goal is to reduce exceptions and make credential handling predictable. A single standard simplifies rollout, support, sharing, and policy enforcement. The key is to remove friction so users do not route around the control with email, chat, or local documents.

Technical breakdown

Why password reuse undermines authentication assurance

Password reuse turns one compromised credential into a reusable access path across multiple services. Even when organisations deploy password managers, the control only helps if users create unique credentials and stop copying them into other channels. In identity terms, reuse defeats the assurance that a login event maps to a specific account and a specific service. It also widens the blast radius of phishing and credential stuffing because a single exposed password may unlock unrelated systems. This is a human identity failure first, but it becomes an enterprise access problem as soon as the same secret is trusted in more than one place.

Practical implication: treat password reuse as an authentication assurance failure, not a user preference issue.

Why informal storage breaks credential governance

Storing passwords in computer documents or on paper creates untracked secret copies that sit outside policy, logging, and recovery controls. Once a credential exists in an unmanaged format, the organisation loses visibility into who can read it, where it was copied, and whether it was shared further. That makes revocation and change control ineffective because the password can persist in places the IAM team cannot enumerate. This is especially important in distributed work environments where employees improvise around friction rather than follow approved channels. The governance problem is not storage medium alone, but loss of lifecycle control over the secret.

Practical implication: eliminate uncontrolled password storage as part of credential lifecycle governance.

How company-wide standardisation changes the control model

Requiring the same password manager across the organisation changes password handling from an individual habit to a managed control surface. Standardisation can improve sharing, rotation, onboarding, and offboarding because the identity team can define one expected process instead of many informal ones. It also reduces the number of exceptions IT must support when employees choose different tools or fallback methods. But standardisation only works when paired with rollout support, clear policy, and friction reduction. Without that, employees simply route around the control and keep using email, chat, or manual methods.

Practical implication: pair standardisation with rollout support so policy does not drive users back to shadow workarounds.

NHI Mgmt Group analysis

Password manager adoption does not equal password governance maturity: This survey shows that a mainstream tool can coexist with weak credential behaviour when organisations leave informal storage and reuse untouched. The real control gap is not product availability but policy enforcement across the full credential lifecycle. Practitioners should read the adoption figure as a baseline, not a sign of governance success.

Credential sprawl now includes human workarounds: Computer documents, paper notes, email, and chat are all shadow repositories for secrets, even when a formal password programme exists. That creates unmanaged copies that evade audit, offboarding, and incident response. The practical conclusion is that password governance has to cover where people actually store and transmit credentials, not just where policy says they should.

Weak password practice is a cross-domain identity problem: The same reuse behaviour that weakens human authentication also normalises unsafe handling for shared accounts and delegated access paths. When employees treat passwords as portable artefacts, the organisation loses confidence in access boundaries. That is why password policy belongs alongside IAM operating standards, not as a standalone awareness campaign.

Password standardisation is a governance decision, not a convenience feature: Requiring one approved password manager across the organisation turns credential handling into a controllable process with fewer exceptions. The survey’s findings show that adoption rises when the organisation reduces friction and gives IT a defined operating model. The practitioner takeaway is to measure whether the policy changed behaviour, not merely whether the tool was deployed.

What this signals

Password governance fails when organisations measure adoption but not behaviour. A password manager can be common and still leave the enterprise exposed if people continue storing credentials in documents, reusing passwords across sites, or sharing them through informal channels.

Credential shadow storage: Once passwords live outside the approved manager, they become unmanaged secrets with no clean lifecycle, no reliable offboarding path, and no usable audit trail. That pattern matters because IAM teams cannot govern what they cannot inventory.

The practical signal for security leaders is that password policy must be enforced as an operating model, not communicated as advice. If users still need workarounds to get their job done, the control design has not yet matched the real workflow.

For practitioners

• Standardise one approved password manager Define a single approved password manager for the organisation and make it the default path for creating, storing, and sharing credentials. Back the policy with onboarding support so users do not fall back to email, chat, or manual storage.
• Eliminate document-based password storage Search for passwords stored in files, shared drives, and local documents, then replace those storage paths with governed secret handling. Treat those files as unmanaged secret copies, not harmless convenience tools.
• Reduce password reuse across services Enforce unique passwords for every account and service, and align that policy with password manager rollout so users have a practical way to comply. Reuse should be monitored as a credential-risk indicator, not just a user habit.
• Replace ad hoc sharing channels Remove email, chat, and conversation-based password sharing from normal operations by giving teams an approved encrypted sharing method. If a password must be transmitted, the process should be auditable and supported by policy.

Key takeaways

• Mainstream password manager adoption does not eliminate weak password behaviour when people still rely on documents, paper, and ad hoc sharing.
• The survey evidence shows that reuse and informal storage remain widespread, which keeps human authentication exposure high even in organisations with formal tools.
• IAM teams should focus on standardisation, lifecycle control, and user workflow alignment if they want password policy to change outcomes.

Key terms

• Password Manager: A password manager is a system that creates, stores, and fills credentials so users do not need to remember or reuse them. In governance terms, it reduces secret sprawl, supports unique passwords per account, and creates a more auditable path for sharing and revocation.
• Password reuse: Password reuse is the practice of using the same password across multiple accounts. It turns one successful compromise into a much larger account takeover problem because the attacker can try the stolen credential elsewhere, widening the blast radius beyond the original target.
• Credential Governance: Credential governance is the discipline of controlling how secrets are issued, stored, rotated, revoked, and monitored across an environment. For NHIs, it also includes ownership and entitlement review, because a valid secret without governance becomes a standing path to misuse.
• Shadow Storage: Shadow storage is any unofficial place where credentials are kept outside approved security controls, such as documents, notes, or ad hoc shared files. It creates hidden copies of secrets that are difficult to audit, revoke, or clean up during offboarding.

Deepen your knowledge

NHI governance, identity lifecycle, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.