Password Management

Summary

Good password management is the single most important thing you can do to protect your business from cyber attacks. The key rules are simple: use a password manager, never reuse passwords, and enable multi-factor authentication (MFA) on every account.

The Core Rules

1. Use a Password Manager

A password manager generates and stores strong, unique passwords for every account. You only need to remember one master password—the rest are generated automatically.

Recommended options:

• 1Password — Best overall for teams; business plans start at ~$4/user/month
• Bitwarden — Open-source, free for personal use; business plans start at ~$3/user/month
• Built-in managers: Apple iCloud Keychain (free with Apple devices), Google Password Manager (free with Google accounts), Microsoft Authenticator (free with Microsoft accounts)

If you’re just starting: Pick one that works with your devices and start adding accounts. Import your existing passwords and let the manager flag duplicates.

2. Never Reuse Passwords

If one account gets breached, attackers will try the same email and password on every other service you use. With a password manager, every account gets a unique password—so a breach on one service doesn’t compromise your others.

3. Pick a Good Master Password

Your master password is the one password you need to remember. Make it a passphrase—4 or more random words joined together:

Good: purple-tiger-coffee-radar-elevator
Bad: password123 or iloveyou or your pet’s name

Don’t change it frequently—just make it strong and unique.

4. Use MFA Everywhere

Even with unique passwords, enable multi-factor authentication (MFA) on every account that offers it—especially email, banking, and admin accounts. Use an authenticator app or security key instead of SMS when possible.

Cost vs. Risk

A password manager costs $3–4 per user per month. A single Business Email Compromise (BEC) attack—where a scammer tricks your bookkeeper into wiring money—costs businesses an average of $75,000 (FBI IC3, 2024). The math speaks for itself.

Take Action Today

1. Sign up for a password manager (1Password, Bitwarden, or your device’s built-in manager).
2. Import your existing passwords.
3. Identify the 3 most important accounts (email, banking, admin)—change their passwords and enable MFA.
4. Train your team to use the same password manager.

Password vs. Passphrase

• Password: A single string of characters (e.g., Xq9$%v2L8!pWm). Best for accounts you never need to type manually—like the ones stored in your password manager.
• Passphrase: Multiple words strung together (e.g., correct-horse-battery-staple). Easier to type and remember—ideal for your master password and email account.

For more details: Password vs. Passphrase — When & What to Use

Related Pages

• fido-passkeys — The modern alternative that replaces passwords entirely
• microsoft-security-for-smb — Microsoft’s MFA/security defaults
• google-workspace-security — Google’s 2SV and security key recommendations
• cisa-cyber-essentials — Password hygiene is one of the four essential shields
• pci-dss — Passwords are a top breach cause in payment card data
• cyber-resource-center — Master page with all resources

Sources

• Password vs. Passphrase: When & What to Use (Password Bits)
• Password Cracking Calculator (Password Bits)
• Protect yourself: small business — Apple guide (ACSC + Apple)
• PCI DSS Small Merchant Guide — Weak passwords identified as a top breach cause