Password security for small teams: a 15-minute fix

Most small-business breaches don't start with a genius hacker. They start with a password that was reused somewhere that got breached. Attackers take those leaked email-and-password combos and try them everywhere — your email, your bank, your Microsoft 365. If your team reuses passwords, one old leak can open every door.

Three changes fix the vast majority of this. You can start all three in about 15 minutes.

1. Give everyone a password manager

You cannot remember a unique, strong password for 80 different sites — so nobody does, which is exactly the problem. A password manager remembers them for you. Each person memorizes one strong master password; the tool generates and fills the rest.

This single change kills password reuse, makes every login long and random, and lets you share a login with a teammate without texting it around. It's the highest-impact thing on this list.

Make the master password a passphrase

Four or five random words — correct-battery-harbor-mango — are easy to remember and very hard to crack. Length beats complexity. And ignore the old advice to change passwords every month; forced rotation just makes people pick weaker, predictable ones. Change a password when there's a reason to (a breach, someone leaving), not on a calendar.

2. Turn on multi-factor authentication (MFA) everywhere

MFA means a stolen password isn't enough on its own — the attacker also needs the code on your phone. It is the single most effective control against account takeover.

Turn it on for everything that matters, starting with the crown jewels:

• Email and Microsoft 365 / Google Workspace
• Banking, payroll, and payment tools
• Your password manager itself
• Anything storing customer data

Prefer an authenticator app (or a hardware key) over text-message codes when you can — SMS can be intercepted, but it's still far better than no MFA at all.

3. Kill shared and orphaned logins

The "everyone uses the same admin login" account is a security black hole — when someone leaves, you can't tell who did what, and the password rarely gets changed. Give people their own accounts, and build a simple offboarding habit:

• Disable the person's accounts the day they leave.
• Reset any shared passwords they knew.
• Remove them from the password manager and revoke MFA devices.
• Forward or archive their mailbox before deleting the account.

The payoff

Do these three things and you've closed the door on the most common way small businesses get hacked — leaked, reused passwords. It's cheap, it's fast, and it protects your money, your data, and your reputation all at once.

Want it rolled out for your whole team — password manager, MFA, and a proper offboarding process — without the headache? We set this up for DC businesses every week.