Your company’s passwords are in an Excel file: what should replace it?

The scenario in brief

Example, made up for illustration. A fictional SME of twelve people keeps all its logins in a single Excel file, ‘Codes.xlsx’, on the shared drive: online banking, the email admin account, the website, supplier portals, the alarm, the Wi-Fi. The file is protected by a password that everyone knows, because people need to open it.

Over the years, the file has been emailed to a new colleague, copied to a USB stick for a quick fix, and opened on a laptop left in a car. An accountant who left two years ago may still have a copy. No one can say who has opened it, or when. And most of the passwords have never changed.

Nothing bad has happened. But the day this file leaves the company, it is not just one account at risk: it is every account at once.

Why an Excel file is a poor hiding place

Excel is a spreadsheet, not a safe. Microsoft says so itself: worksheet protection ‘isn’t intended as a security feature’; it only stops people changing cells. And for the password that locks the whole file, Microsoft warns that ‘locking a file with a password does not necessarily protect your file from malicious intent’.

The real problem is not technical, it is practical. A file gets copied, forwarded and synced to every computer and phone that has opened it. You cannot ‘take it back’ from someone who leaves.

• One password for everyone: the file’s password. It is passed on by word of mouth, often by email.
• All or nothing: the intern who needs the Wi-Fi can also see the bank login.
• No trail: there is no way of knowing who opened the file, copied a line or kept a copy.
• Copies everywhere: attachments, USB sticks, downloads, recycle bins, old computers.
• Passwords that never change: changing them means updating the file and telling everyone, so it does not happen.
• Forget it and it’s gone: if the file’s password is lost, Microsoft says it cannot retrieve it.

And passwords are the number one target. In its annual Digital Defense Report, Microsoft states that more than 97% of identity attacks are password attacks, and that identity-based attacks rose by 32% in the first half of 2025.

What cybersecurity experts recommend

France’s national cybersecurity agency (ANSSI), whose guides are a reference well beyond France, leaves no room for doubt. In its guide to authentication and passwords (in French), it says that options such as ‘using an office file protected by a password are to be ruled out’, because they do not offer the same level of protection as a tool built for the job. Its guide for small businesses (in French) then sets out four simple rules.

1. A length that matches the stakes: at least 15 characters for a critical service (bank, email, accounting), at least 9 for a less critical one, mixing upper and lower case letters, numbers and special characters.
2. A different password for every service, so the damage stays limited if one of them leaks. And never the same one for personal and work email.
3. A password manager (ANSSI calls it a ‘vault’), which generates strong passwords and keeps them in an encrypted file, opened with a single password.
4. Multi-factor authentication whenever the service offers it: on top of the password, a second element, such as a code on your smartphone.

When a login genuinely cannot be individual (Wi-Fi, an old piece of software), the manager lets you share it without revealing it, and remove access for one person only. For everything else, aim for one account per person (see below).

But is it wise to put everything in one place? ANSSI is open about the downside: the manager’s master password is ‘very critical’, and if it were compromised, every password in the vault would be exposed. So it must be strong and kept in your head, and many tools let you add a second factor to it. The risk is still far lower than that of a file doing the rounds.

Excel or a password manager: what actually changes

A password manager is software that stores passwords in an encrypted database, meaning it cannot be read without the right key. Each person opens it with their own master password, on their computer and smartphone. Business versions add shared vaults per team and a console to manage access.

That last point matters more than it seems: a password manager only offers to fill in a password on the website it was saved for. On a fake login page, it stays silent, which is already a warning sign. But it does not stop someone copying or typing their password into a fake page themselves: hence the value of multi-factor authentication on important accounts.

Questions to ask before you choose

Rather than recommending a brand, here are the points to check with your IT provider or the software vendor. ANSSI also recommends that the people in charge of IT make a password manager available to everyone and train each person to use it.

The migration in six steps, without breaking anything

Moving from a file to a password manager is mostly about method, and order matters.

1. Take stock of the file. Line by line: does this account still exist? Who needs it? Delete dead logins and note the shared accounts.
2. Set up the tool and secure the vault. Turn on multi-factor authentication for everyone, and make sure at least two people can manage access, so you never depend on just one.
3. Create vaults per team. Management, accounts, reception, IT: each gets only what they need.
4. Change each password as you move it. The file has been passed around: assume its passwords are known. As you move them, replace them with passwords generated by the tool, starting with the bank, email and accounting.
5. Delete the file and its copies. Shared drive, email attachments, downloads, USB sticks, recycle bins. A forgotten old file still holds the old passwords, hence step 4.
6. Train the team. A short session is enough: open the vault, fill in a password, create a new one, know what to do if a phone is lost.

The trap: importing the file as it is into the password manager and stopping there. The old passwords still work, and copies of the file are still lying around. Step 4 is not optional.

The second trap: keeping a printed copy or a new backup file ‘just in case’. Your backup is the tool’s recovery procedure, set up in step 2.

And where you can, get rid of the shared password

The best shared password is the one that no longer exists. Many services let you create one account per person instead of a shared one: online banking with a login per user, email with shared mailboxes reached from each person’s own account, supplier portals with several users.

Each personal account can then have its own multi-factor authentication, and be closed the day the person leaves without changing anything for the others. The shared vault remains useful for what genuinely cannot be individual, such as the Wi-Fi or an old business application.

Monday morning: five actions

1. Search the shared drive and your email for files containing ‘password’, ‘codes’ or ‘logins’. You will see how many copies exist.
2. List the three most sensitive logins: bank, email (admin account), accounting. These are the first to move and change.
3. Check that multi-factor authentication is switched on for those three accounts.
4. Ask your IT provider which business password manager they recommend and how it fits with your tools.
5. Set a date to delete the Excel file, and stick to it.

None of this needs technical skills. It is mostly a matter of order, and of discipline on the day someone leaves the company.

Manage your passwords better→