How bad is it really to keep account credentials in a password-protected spreadsheet?

The first thing to establish is which spreadsheet feature is in use, because two very different things share the word "password".

Sheet or workbook protection — the option that stops editing or hides structure — provides essentially nothing. The contents are not encrypted; it is an instruction to the application, and the underlying file can be read without it.

File encryption on open — where the file cannot be opened at all without the password — is real cryptography in current versions of the major office suites, and it is not trivially broken if the password is strong.

So the answer depends entirely on which one your team is using, and a lot of people believe they have the second when they have the first. That is worth checking before anything else, because if it is the first, this is not a debate about degrees of protection.

Even granting real encryption, the gaps against a password manager are structural rather than cryptographic:

• Protected at rest only. Once open, everything is in memory, on screen, and often in a temporary file. A password manager decrypts one entry at a time and clears the clipboard.
• No access control granularity. Anyone who can open the file gets every credential. A manager gives per-item sharing, so a contractor gets the two entries they need.
• No audit trail. You cannot answer "who saw the production database password", which matters enormously when someone leaves.
• No rotation workflow. When somebody departs you must change everything in the file, and nothing tells you what depends on what.
• Copies proliferate. Spreadsheets get emailed, backed up, synced and attached. Every copy is a permanent snapshot of your credentials at that moment, and old copies are not invalidated by changing anything.

That last one is the killer in practice. The exposure is not the file you know about; it is the four copies you do not.

The organisational argument that usually moves teams faster than the technical one: a shared spreadsheet makes shared accounts the path of least resistance, and shared accounts are the underlying problem.

When the credential store is a file everybody opens, the natural design is one account that everyone uses. That destroys attribution — you cannot tell who did anything — and it makes offboarding a rotation exercise instead of a deletion.

A password manager makes individual accounts and per-person access easy enough that teams drift toward them. The tool changes the default, and the default is what you actually end up with a year later.

So the answer to "what does the spreadsheet fail to do" includes things that are not about the file at all.

If for some reason a managed tool is not available, the intermediate step that is genuinely better than a spreadsheet is a purpose-built encrypted database file — the kind that stores one credential per entry, locks after inactivity, handles clipboard clearing, and can be kept in version control or synced without the plaintext ever existing on disk.

It does not solve access granularity or auditing, but it removes the whole-file exposure and the accidental copy problem. It is also free, which removes the usual objection to changing anything.