A non-transitory computer readable storage medium comprising instructions that, when executed by at least one processor, cause a content management system to: retrieve a public key set comprising one or more public encryption keys associated with one or more additional client devices in connection with providing access to a shared folder of the content management system, wherein the one or more additional client devices are additional to an initial client device; provide the public key set to the initial client device associated with an account of the content management system; receive, from the initial client device for storage within the shared folder: an encrypted payload comprising a set of passwords; and encrypted versions of a shared encryption key encrypted utilizing the public key set, wherein the shared encryption key is utilized to encrypt the set of passwords; detect a key rotation event for changing the shared encryption key; in response to the key rotation event, send an indication of the key rotation event to a plurality of client devices having current membership access to the shared folder; retrieve an updated public key set from a plurality of client devices; provide the updated public key set to the plurality of client devices; receive, from an initiator device of the plurality of client devices for storage within the shared folder: an updated encrypted payload comprising the set of passwords; and encrypted versions of a modified shared encryption key encrypted utilizing the public key set, wherein the modified shared encryption key is utilized to re-encrypt the set of passwords; and determining that the updated encrypted payload received from the initiator device is valid by determining that a version number of the modified shared encryption key matches a version number stored in connection with the shared folder, wherein the initiator device comprises a client device that successfully rotates the shared encryption key by generating the modified shared encryption key and committing the updated encrypted payload to the shared folder. retrieve a public key set comprising one or more public encryption keys associated with one or more additional client devices in connection with providing access to a shared folder of the content management system, wherein the one or more additional client devices are additional to an initial client device; provide the public key set to the initial client device associated with an account of the content management system; receive, from the initial client device for storage within the shared folder: an encrypted payload comprising a set of passwords; and encrypted versions of a shared encryption key encrypted utilizing the public key set, wherein the shared encryption key is utilized to encrypt the set of passwords; an encrypted payload comprising a set of passwords; and encrypted versions of a shared encryption key encrypted utilizing the public key set, wherein the shared encryption key is utilized to encrypt the set of passwords; detect a key rotation event for changing the shared encryption key; in response to the key rotation event, send an indication of the key rotation event to a plurality of client devices having current membership access to the shared folder; retrieve an updated public key set from a plurality of client devices; provide the updated public key set to the plurality of client devices; receive, from an initiator device of the plurality of client devices for storage within the shared folder: an updated encrypted payload comprising the set of passwords; and encrypted versions of a modified shared encryption key encrypted utilizing the public key set, wherein the modified shared encryption key is utilized to re-encrypt the set of passwords; and an updated encrypted payload comprising the set of passwords; and encrypted versions of a modified shared encryption key encrypted utilizing the public key set, wherein the modified shared encryption key is utilized to re-encrypt the set of passwords; and determining that the updated encrypted payload received from the initiator device is valid by determining that a version number of the modified shared encryption key matches a version number stored in connection with the shared folder, wherein the initiator device comprises a client device that successfully rotates the shared encryption key by generating the modified shared encryption key and committing the updated encrypted payload to the shared folder.