Weak passwords are one of the most exploited entry points for attackers. This guide provides practical password security practices for small business employees and teams. Follow these steps to protect your organization's critical accounts and data.
Creating Strong Passwords
What Makes a Password Strong?
Strong Password Checklist
- At least 12 characters long (longer is better than complex)
- Mix of character types: Uppercase, lowercase, numbers, and symbols
- Unique: Never reuse the same password across multiple accounts
- Unpredictable: Not based on dictionary words, common names, or personal information (birthdate, pet names, etc.)
- Unrelated to your username or role
Examples: Strong vs. Weak
| Weak Password | Strong Password | Why? |
|---|---|---|
| password123 | M7@kxQn9$pL2 | Weak: common word + numbers. Strong: random mix, 12 chars. |
| abc123 | 9T#vRw4&bZ1$Ky | Weak: sequential. Strong: no pattern, mix of all types. |
| JohnSmith2024 | Coffee7!Green&Maps | Weak: uses name + year. Strong: random phrase, harder to guess. |
| Password1! | 3L@x2Pw&9Q$mN | Weak: predictable word. Strong: no recognizable words. |
Passphrase Method (Easier to Remember)
If random passwords are hard to remember, try a passphrase: a sequence of random words with numbers and symbols mixed in.
Passphrase Example
- Think of a random sentence: "My cat eats 7 blue socks daily"
- Take first letters and add numbers/symbols:
Mce7bs*D! - Result: 10 characters, memorable, strong
Protecting Your Passwords
Use a Password Manager
DO: Use a Password Manager
- Store all passwords: A password manager (like Bitwarden, 1Password, Dashlane, or LastPass) securely stores passwords so you only need to remember one master password
- Generate strong passwords: Most password managers have a "generate password" feature for truly random passwords
- Sync across devices: Access your passwords on phone, tablet, and computer safely
- Share securely: Some managers let you share passwords with team members without exposing the actual password
- Monitor for breaches: Many alert you if your password appears in a known data breach
Never Share Passwords
DON'T Do These Things
- Write passwords on sticky notes or in unencrypted documents
- Email passwords or share via messaging apps
- Tell anyone your password in person or over the phone
- Use public WiFi to log in to sensitive accounts
- Allow your browser to save passwords if your computer is used by others
- Reuse passwords across work and personal accounts
- Use the same password for multiple people to access one account (shared logins make accountability impossible)
Multi-Factor Authentication (MFA): The Game Changer
What is MFA?
Multi-Factor Authentication (MFA) adds a second check beyond your password. Even if someone steals your password, they can't access your account without the second factor. This is one of the highest-impact security improvements you can make.
Types of MFA (From Weakest to Strongest)
MFA Methods Ranked
- SMS text code (acceptable): A code texted to your phone. Better than nothing, but phone numbers can be hijacked.
- Email code (acceptable): A code sent to your email. Similar to SMS, more secure if your email is well-protected.
- Authenticator app (recommended): Apps like Microsoft Authenticator, Google Authenticator, or Authy generate a new code every 30 seconds. More secure than SMS.
- Security keys (strongest): Physical USB devices that you tap to prove your identity. Best protection against phishing, but requires hardware.
Enable MFA on Critical Accounts First
Not every account needs the same level of protection, but prioritize these:
- Email account (compromise = access to everything else)
- VPN or remote access
- Financial systems and banking
- Cloud storage (OneDrive, Google Drive, etc.)
- Work collaboration tools (Microsoft Teams, Slack, etc.)
- Privileged accounts (admin access)
Changing Your Password: When and How
Periodic Password Changes
Password Rotation Schedule
- Critical accounts: Change every 60–90 days, or if you suspect compromise
- Regular accounts: Change every 6–12 months, or if you suspect compromise
- After a breach: If your organization experiences a data breach involving this account, change immediately
- If compromised: If you suspect someone has access, change immediately and review account activity
Checking if Your Password Has Been Breached
Use a free service like Have I Been Pwned (haveibeenpwned.com) to check if your email or password appears in any known data breach. If it does, change your password immediately, especially if you reuse it elsewhere.
Password Policy for Organizations
Best Practices to Implement
Recommended Password Policy
- Minimum length: 12 characters (longer is better)
- Complexity: Mix of uppercase, lowercase, numbers, and symbols
- No reuse: Don't allow users to cycle through the same passwords
- No shared accounts: Every user should have their own account for accountability
- Password manager recommended: Provide or recommend a password manager for all staff
- MFA required: Especially for administrative accounts and remote access
- Offboarding process: When people leave, disable and change all shared account passwords
Avoid These Common Mistakes
DON'T Implement These
- Don't require password changes every 30 days: This causes people to use predictable patterns or weak passwords
- Don't require overly complex passwords: People will write them down or reuse them
- Don't allow shared accounts: You can't track who accessed what
- Don't forbid password managers: Employees need somewhere to store strong passwords
- Don't let people store passwords in browsers: Too easy to access or extract
Training Your Team
Password security depends on everyone following best practices. Share these tips with your team:
- Educate: Train employees on password creation and security in onboarding
- Simulate phishing: Send fake phishing emails to see who's at risk of being tricked into sharing passwords
- Encourage reporting: If someone suspects their password is compromised, they should report it immediately
- Reinforce regularly: Password security reminders in newsletters or security awareness campaigns help
- Set the example: Leaders who follow best practices make it the norm for everyone
Quick Action Checklist
Do This This Week
- Review your current passwords—any that are short or reused?
- Check haveibeenpwned.com to see if your accounts have been in a breach
- Set up a password manager (even free ones like Bitwarden help)
- Enable MFA on your email and critical work accounts
- Create a strong new password for one account today
- If your organization doesn't have a password policy, recommend one to leadership