Topic starter
08/07/2026 6:57 pm
TL;DR: Password managers are now used by 86% of organisations, yet 53% still rely on computer documents and 29% on pen and paper, while 92% of respondents continue reusing passwords across multiple sites, according to Bitwarden’s 2022 Password Decisions Survey of 400+ IT decision makers. Convenience has improved, but credential hygiene remains structurally weak.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “2022 Password Decisions Survey”.
By the numbers:
- Password managers are now used by 86% of organisations, according to Bitwarden.
- Bitwarden says 53% still rely on computer documents to manage passwords.
- Bitwarden reports that 29% still use pen and paper for password management.
Key questions
Q: What is the biggest password security failure when organisations already use a password manager?
A: The biggest failure is assuming the tool fixes behaviour on its own.
Q: Why do employees still create password risk after a company rolls out password management tools?
A: Employees usually keep using familiar workarounds when the approved process feels slower or harder than the informal one.
Q: How can organisations tell whether password governance is working?
A: They should measure ticket reduction, reset completion time, audit trail quality, and whether emergency recovery works across all connected identity systems.
Practitioner guidance
- Standardise one approved password manager Define a single approved password manager for the organisation and make it the default path for creating, storing, and sharing credentials.
- Eliminate document-based password storage Search for passwords stored in files, shared drives, and local documents, then replace those storage paths with governed secret handling.
- Reduce password reuse across services Enforce unique passwords for every account and service, and align that policy with password manager rollout so users have a practical way to comply.
Bottom line: Mainstream password manager adoption does not eliminate weak password behaviour when people still rely on documents, paper, and ad hoc sharing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:20 pm
Password manager adoption does not equal password governance maturity: This survey shows that a mainstream tool can coexist with weak credential behaviour when organisations leave informal storage and reuse untouched. The real control gap is not product availability but policy enforcement across the full credential lifecycle. Practitioners should read the adoption figure as a baseline, not a sign of governance success.
A question worth separating out:
Q: Should organisations require the same password manager everywhere?
A: Yes, when the goal is to reduce exceptions and make credential handling predictable. A single standard simplifies rollout, support, sharing, and policy enforcement. The key is to remove friction so users do not route around the control with email, chat, or local documents.
👉 Read our full editorial: Password managers are mainstream, but password practices still fail