When someone leaves an organization, every vault they had gets a new key, so nothing saved from then on reaches them. But a password they saw is a password they may have kept. The only fix is to change it at the website. Offboarding says which ones, and helps you change them.
See who left
In the console, Members, Offboarding lists everyone who left, was removed, or was taken away by your identity provider, with what that means: how many items they could open, and how many still hold what they saw.
Change what they saw
Security, in the web vault and the browser extension, lists the items under Seen by someone who left.
- In the browser extension, Fix password changes each one on the site, with you confirming.
- Elsewhere, a link opens the site’s change page.
An item leaves the list the moment its password changes. For an item without a password, such as a note or an API credential, any edit counts.
The report
Report downloads a list of everything the person could open: the item, its kind, its vault, and whether it has changed since, and when. It holds no passwords, and it’s made on your own device.
Close it
Dealt with closes the offboarding, as when what’s left needs no changing. The audit log says who closed it.
What to know
- Passwords are changed one at a time, by an admin: nothing is changed unasked.
- An item moved or deleted since isn’t listed.
- Taking a vault from someone who stays in the organization, as when they change teams, isn’t an offboarding.
- The list is shown in the web vault and the desktop app, not in the phone apps.
Last updated October 4, 2026