Inventory Password Spreadsheets

Find every credential record before choosing a destination

A migration begins with discovery, not encryption. Inventory spreadsheets, CSV exports, cloud sheets, emailed copies and printed working lists without copying secret values into the inventory itself.

Use a controlled sequence

1. 01Name one accountable migration owner and a separate reviewer.
2. 02Search approved storage locations, cloud drives, Downloads, email attachments and removable media.
3. 03Record file name, format, owner, modified date, sharing state and business purpose without reproducing passwords.
4. 04Freeze editing and revoke access that is no longer authorized.
5. 05Choose the authoritative source for each account before combining records.

Leave evidence without copying secrets

Record a neutral identifier, location, custodian, file format, sharing state, last-modified date, business owner and disposition decision. Never turn the discovery log into another plaintext secret list.

Pause and review when

• People keep editing different copies during the inventory.
• The inventory contains actual passwords or recovery codes.
• Former staff or public links still have access.

Encrypted files are not a password manager

Encrypted-file storage is not password autofill, browser sync or a general credential manager. Match the system to the user task and test recovery before removing the source.

Run the final independent check

Before closing the inventory, ask a second reviewer to compare the discovery log with approved drive locations, cloud-sharing reports, browser download folders and removable-media records. Resolve every unexplained source, owner and access grant. The inventory is complete only when each located copy has an accountable decision: migrate, retain temporarily under control, or dispose after validation. A blank owner field is a risk finding, not an administrative detail.

Resolve these before acting