Put credentials that humans type into a team password manager, and credentials that software reads into a secrets manager. The test is who or what uses it. A shared login for a dashboard is a person's secret. A database password for a service is a machine's secret.
Definitions
Password manager. A tool that stores logins, shares them with groups and fills them into browsers. Built around people.
Secrets manager. A service that stores credentials and hands them to applications through an API, with access control, audit logs and often rotation. Built around workloads.
Decision table
| Credential | Who uses it | Where it belongs |
|---|---|---|
| Admin login to a SaaS dashboard | People | Team password manager, plus individual accounts if possible |
| Database password for an application | Software | Secrets manager |
| API key used in CI | Pipeline | Secrets manager or CI secret store, short lived if possible |
| Wi-Fi or shared device password | People | Password manager |
| Signing key for releases | Pipeline and a few people | Secrets manager or key service, tightly scoped |
| Personal access token | One person | That person's password manager, not shared |
Why not one tool for both
A password manager has no good way to give a running service a credential without a human copying it. That copy ends up in a config file or chat. A secrets manager has no good fit for a person typing into a login page. Using the wrong tool pushes people toward workarounds.
OWASP's guidance for secrets managers stresses least privilege, audit logs of access and use, and automating rotation where possible. Those are workload features.
Shared logins are a smell
If a login is shared, you lose attribution. When something changes you cannot say who did it, and offboarding means changing the password for everyone. Prefer named accounts with single sign on. Where a vendor only offers a shared login, store it in the team password manager, limit the group, and rotate it when anyone leaves. See shared credentials versus individual accounts.
Steps to clean up
- Inventory shared credentials from chat, wikis, spreadsheets and repositories.
- Classify each as people or machine.
- Move people secrets to the password manager and machine secrets to the secrets manager.
- Rotate everything that sat in plain text, since it is exposed.
- Delete the old copies and scan for stragglers.
Quick check
Can a password manager hold API keys?
It can store them, which beats a spreadsheet. But applications should fetch them from a secrets manager so no person has to copy them.
Do we need both for a small team?
Often a password manager plus your CI platform's secret store is enough to start. Add a secrets manager when more services need credentials.
Safeguard can scan for credentials left in code and supports policy controls, and you can try a free scan.
Sources
Last reviewed: 19 October 2026.
