Strong Passwords and Password Managers for Small Teams

Password advice has changed. The old rules, such as forcing a capital letter, a number and a symbol and a change every 90 days, produced predictable results: "Summer2024!" followed by "Summer2025!". Current guidance from standards bodies such as NIST focuses on length, uniqueness and checking against known leaked passwords, and it advises against forced periodic changes unless there is evidence of compromise.

This article explains what a good password policy looks like for a small business and how a password manager makes it practical.

What makes a password strong

• Length: longer is stronger. Aim for at least 12 to 16 characters for ordinary accounts, longer for the critical ones.
• Randomness: a random string or a passphrase of several unrelated words is much harder to guess than a clever variation on a name or date.
• Uniqueness: every account gets its own password. When one site is breached, attackers try the leaked password everywhere else, an attack called credential stuffing.

A passphrase such as four or five random words is easy to type and remember for the few passwords you must memorise, such as your password manager's master password. For everything else, let software generate long random passwords.

Policy rules that help, and rules that do not

Do	Avoid
Set a sensible minimum length and allow long passphrases	Forcing composition rules like "one symbol, one capital"
Block known breached and very common passwords	Forcing changes every few weeks for no reason
Require two-factor authentication on important accounts	Allowing the same password on many systems
Allow pasting into password fields	Blocking paste, which discourages password managers
Change a password immediately after a suspected compromise	Keeping passwords in spreadsheets or chat

What a password manager does

A password manager is an encrypted vault. You remember one strong master password, and the manager stores a unique password for every account, fills them in for you and generates new ones on request. Features that matter:

• Strong encryption with a design where the provider cannot read your vault contents.
• Autofill tied to the website address, which also protects you from phishing, since the manager will not fill a password on a lookalike domain.
• A password generator with adjustable length.
• Two-factor authentication on the vault itself.
• Breach alerts and reports about reused or weak passwords.
• Secure sharing and team vaults for business use.

There are good commercial and open-source options, and reputable browsers include basic built-in managers. For a team, a dedicated manager with shared vaults and an admin console is usually the better choice.

Sharing logins safely in a small team

1. Never share passwords by email, chat or a spreadsheet. Those copies live on, forever, in places you cannot easily clean up.
2. Use shared vaults organised by function, such as marketing, hosting and finance, with access limited to the people who need them.
3. Prefer individual accounts over shared logins wherever the service allows, so you can see who did what and revoke one person easily.
4. Remove access when someone leaves, then change passwords for shared accounts they could see.
5. Keep emergency access arranged for the owner, so a single person's absence does not lock the business out.

Getting started in an afternoon

1. Choose a manager and set a long master passphrase. Write a recovery kit if offered, and store it somewhere physically safe.
2. Turn on 2FA for the manager.
3. Start with the high-value accounts: email, domain registrar, hosting, payment providers and the website admin.
4. Replace each password with a generated one as you log in. Do the rest over the next weeks.
5. Run the manager's report to find reused and weak passwords, and fix those first.

Common objections

"If the vault is breached, I lose everything." A well-designed vault is encrypted with a key derived from your master password, which the provider does not hold. The risk is real but small compared with the near certainty that reused passwords will leak somewhere. "It is a single point of failure." Which is why you protect it with a long master passphrase and 2FA, and keep an emergency recovery option.

Training people without nagging

A policy only works if people can follow it. Keep the message short: use the manager, never reuse a password, turn on 2FA, and report anything odd straight away. Run a short walkthrough when someone joins, and make it easy to ask questions, for example by pointing people to the knowledge base for hosting how-tos. Teach the common tricks too, such as emails that urge you to log in urgently through a link, since a password manager will refuse to autofill on a fake domain and that mismatch is a useful warning sign. Treat mistakes as a reason to fix the process rather than to blame the person, because people who fear blame stop reporting problems.

When a password is exposed

If a service you use announces a breach, or a breach-monitoring service reports one of your accounts, change that password immediately, check whether the same password was used anywhere else, and review recent account activity. Because a manager makes every password unique, a breach at one site stays a problem for that site only.

Passwords for hosting and servers

Hosting control panels, databases, SFTP accounts and CMS admins each need their own unique credentials. Never reuse your Plesk password for WordPress, or either for email. On a Zebra Hosting Cloud plan you create separate accounts and databases from the Plesk panel, so give each its own generated password. See the security page for how we approach protecting the platform.