My last customer did this approach: for Personal Passwords keepass with some rules about how strong the password must be there. Machine passwords or credentials

My last customer did this approach: for Personal Passwords keepass with some rules about how strong the password must be there. Machine passwords or credentials for technical accounts go into an hashicorp vault with the namespace depending on the greater project they belong to.