Stop sharing one password on a sticky note
Lots of church offices have one. A sticky note on the monitor. Or a notebook in the desk drawer. It holds the password for the church email, the giving site, the website, and the Wi‑Fi. Everyone knows it. That’s exactly the problem.
Why one shared password is risky
- You can’t take it back from one person. When a volunteer leaves, they still know it. The only fix is to change it and then tell everyone else again.
- It gets reused. One password usually ends up on five accounts. If one of those sites leaks it, a scammer can try it on all the others. This is called credential stuffing: trying a leaked password on lots of sites to see where it works.
- You can’t tell who did what. If the giving site settings change, the log says “office@” and that’s all. You won’t know which of eight people it was.
- Sticky notes get seen. Visitors, contractors, kids in the church office, the person fixing the copier.
- It’s usually weak. A password everyone has to remember tends to be the church name plus the year.
What a password manager does
A password manager is an app that remembers your passwords for you. It keeps them locked in a vault, an encrypted (scrambled) storage space that opens with one strong master password.
For a church, the useful part is sharing:
- You put the giving-site login in a shared folder. The treasurer and the office manager can use it. Nobody else sees it.
- When someone leaves, you remove them from the folder. Then you change that password once, in one place. Everyone who still needs it gets the new one automatically.
- The app can make a long random password for each account. Nobody has to memorize it.
- Most business plans keep a record of who opened or changed what.
CISA (the U.S. government’s cybersecurity agency) gives the same advice: make long, random, unique passwords and use a password manager to keep track of them (CISA: Use Strong Passwords, an archived page that still applies).
Some real options
We don’t get paid by any of these companies. Any of them beats a sticky note. Prices change, so check the vendor’s page before you buy.
| Option | What we could confirm | Nonprofit discount |
|---|---|---|
| Bitwarden | Free organization lets 2 people share logins, in up to 2 shared folders (“collections”). Teams is $4 per user per month, billed yearly. Enterprise is $6. | Unknown. No public nonprofit rate. Bitwarden’s quote form is the place to ask. |
| 1Password | Teams Starter Pack is $24.95 per month, billed yearly ($299.40 a year), for up to 10 people. Business is $8.99 per user per month, billed yearly. 14-day free trial. | Exists, amount unknown. 1Password says nonprofits “may be eligible for a one-time credit, discounted accounts, or a similar type of support.” It doesn’t list a percentage. |
| Keeper | Has Business Starter, Business, and Enterprise plans billed per user. Free trial. We couldn’t read the prices from Keeper’s page (they load by script). | Unknown. Keeper’s own site lists student and military/medical discounts but no nonprofit one. |
Sources, checked October 19, 2026: Bitwarden business pricing, Bitwarden plan details, Bitwarden request a quote, 1Password business pricing, 1Password for nonprofits, Keeper business pricing.
Rough cost for a small church: 6 users on Bitwarden Teams is 6 × $4 × 12 = $288 a year. The 1Password Teams Starter Pack is $299.40 a year for up to 10 people. Both are before any nonprofit discount you might get by asking.
If you only need two people to share a few logins (say, the pastor and the treasurer), Bitwarden’s free organization may be enough to start.
Set it up this Saturday
Plan on about two hours. One person owns the project. A second person helps test.
Common questions
“What if the password manager gets hacked?” These apps encrypt your vault on your own device. The company isn’t supposed to be able to read it. Nothing is perfect. But a strong master password plus two-step login is far safer than a note on a monitor.
“Our older volunteers won’t use it.” They don’t have to learn much. Install the browser add-on on the office PC. It fills in the login for them.
“Can we just use the browser’s saved passwords?” For one person, that’s okay. For a team, it’s hard to share safely and hard to take away. A password manager is built for sharing.