How should my small business manage passwords?
Use a business password manager, give every person their own login, and make each password long and unique. Turn on two-factor authentication for key accounts. Don't force routine password changes; change a password when there's a reason, such as a breach, a suspicious sign-in or someone leaving. Keep business accounts in the business's name.
The short version
- Use a business password manager with shared vaults.
- One login per person, never shared.
- Long, unique passwords or passphrases for every account.
- Two-factor sign-in on email, banking, domain, website and Google.
- Change passwords for a reason, not on a calendar.
How do I set up passwords for the business?
1. Get a password manager. It creates, stores and fills in strong passwords. Business versions let you share passwords through vaults instead of by text or email, remove someone’s access in one step, and spot weak or reused passwords.
2. Make every password long and unique. If one service is breached, attackers try the same email and password everywhere else. A unique password stops that. Length matters more than symbols. NIST’s SP 800-63B sets a 15-character minimum for passwords used on their own, tells services not to impose mixed-character rules, and says new passwords should be checked against lists of known compromised ones.
3. Add two-factor authentication to the accounts that unlock everything else. See should you turn on two-factor authentication.
4. Give each person their own login. Then you can remove one person without changing everyone’s password. On your website, that also means the right role for each person. See WordPress user roles.
5. Keep a list of who owns what. Domain, hosting, website, email admin, Google accounts, social media, payment tools. Each should belong to the business, not one person. Read which logins your business should own.
Why does it matter?
Most small business break-ins aren’t clever hacking. They start with a reused password, a shared login, or a former employee who still knows it. Password managers also help with phishing: they won’t fill your password into a lookalike site. See how to spot a phishing email.
What are the common mistakes?
- Forced changes every few months. People respond with predictable tweaks. NIST says not to require them.
- Passwords in email, texts or spreadsheets.
- One shared admin login for the whole office.
- Accounts in a former employee’s name or personal email.
- No plan for the password manager itself. Protect it with a strong passphrase and two-factor sign-in, and make sure two trusted people can recover it.
When should I change a password?
- When someone with access leaves. See how to remove a leaver’s email account.
- When a service says it was breached.
- When you typed it into a site you’re unsure about.
- When you see a sign-in you don’t recognize.
What if I’m locked out?
Use the service’s own reset or recovery process. A trustworthy provider confirms who you are before resetting. Nobody legitimate needs you to tell them your current password, and you should never send one by email.
How much does it cost and how long does it take?
Business password managers are sold per user; check each vendor’s current pricing. Moving a small team over usually takes an afternoon, plus a few weeks of replacing old passwords as people sign in.
How does E-3 handle this?
We set up business email. Accounts E-3 sets up are created in the business’s name, and domains E-3 manages are registered to the business. Microsoft 365 and Google Workspace support two-step sign-in; E-3’s own mail server doesn’t offer it yet, so a long, unique password matters even more there. Email support@e3help.me to get organized.
Related questions
Common questions
- Should we change passwords every 90 days?
- No. NIST's current guidance says services shouldn't require periodic changes, but should require a change when there's evidence a password was compromised.
- Is it safe to keep all our passwords in one app?
- A reputable password manager with a strong master password and two-factor sign-in is far safer than reused passwords, spreadsheets or sticky notes.
- How long should a password be?
- Long. NIST's guidelines set a 15-character minimum for passwords used on their own. A passphrase of several random words is easy to type and hard to guess.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.