How to Create Strong Passwords for Your Small Business
Most break-ins to small business accounts don’t need clever hacking. Criminals reuse passwords leaked from other websites, guess common ones, or trick someone into typing their password into a fake login page. A few sensible habits stop most of these attacks.
The advice on passwords has also changed. Rules many of us were taught, such as mixing symbols into every password and changing it every 90 days, are no longer recommended by the main security authorities. This guide sets out what the US National Institute of Standards and Technology (NIST) and the UK National Cyber Security Centre (NCSC) currently advise, and how to put it into practice in a small business.
What the official guidance says now
NIST publishes the standard many organisations use for login security, called SP 800-63B. Its current revision (800-63B-4) and the NCSC’s password policy guidance agree on the main points:
- Length matters more than complexity. NIST says a password used on its own should be at least 15 characters. A password used together with a second check, such as a code on your phone, can be shorter, but no fewer than 8 characters.
- No forced complexity rules. NIST says services should not demand a mix of character types (capitals, numbers, symbols). The NCSC also does not recommend complexity requirements, because people meet them in predictable ways that attackers already expect.
- No forced regular changes. NIST says people should not be required to change passwords on a schedule. The NCSC says regular password changing “harms rather than improves security”, because people make small, guessable changes such as adding 1 to the end. Change a password when there is a reason to think it has been exposed.
- Check new passwords against known bad ones. When a password is set, it should be checked against a list of common, guessable and previously leaked passwords, and rejected if it appears there.
- Allow password managers and pasting. NIST says services must allow password managers and autofill, and should allow pasting into password fields.
- No password hints or security questions. NIST says services should not offer hints that anyone can see, or ask people to set up security questions such as “What was your first pet’s name?”.
Some of these rules are aimed at the people who build login systems. But they also tell you what a good password looks like, and what to do in your own business.
Use long passwords: three random words
A long password is much harder to guess than a short, complicated one. The NCSC’s advice for people who need to remember a password is to combine three random words. Its own example is applenemobiro.
A few points make this work:
- The words must be random. “Ilovemydog” is three words, but it is a phrase people commonly use. Pick words that have nothing to do with each other.
- Avoid personal details. The NCSC advises against names of family members or pets, dates, and sports teams. These are often visible on social media.
- Don’t rely on swaps. Changing “o” to “0” or “a” to “@” adds little, because password-cracking tools try these swaps automatically.
- Add a fourth word if you like. Three short words may not reach the 15 characters NIST suggests for a password used on its own. A fourth random word is an easy way to add length.
You only need to remember a handful of passwords this way: the one for your password manager, your computer or phone login, and your main email account. Everything else can be stored for you.
Use a different password for every account
When a website is breached, the stolen email addresses and passwords are often published or sold. Criminals then try those same details on email, banking, social media and online shop logins. This is called credential stuffing, and it works because many people reuse passwords.
The only reliable defence is a different password for each account. If one site leaks your password, none of your other accounts is affected.
Your email password needs particular care. Whoever controls your email can usually reset the passwords on your other accounts by clicking “forgot password”. Give your email account a strong password you use nowhere else, and turn on two-step verification for it first. If your business still runs on a free webmail address, our guide on using a business email address explains the other reasons to move.
Let a password manager do the remembering
Nobody can remember dozens of long, unique passwords. A password manager is an app that creates strong passwords for you, stores them in an encrypted vault, and fills them in when you log in. You open it with one strong password (and ideally a second check such as your fingerprint).
The NCSC encourages the use of password managers, and NIST says websites must allow them. Some practical points:
- Built-in options are a reasonable start. Most web browsers and phones include a password manager. For a one-person business this may be all you need.
- Teams benefit from a business plan. Dedicated password managers usually offer shared folders, so staff can use a shared login (for example the company’s social media account) without the password being sent by email or WhatsApp. When someone leaves, you can remove their access in one place.
- Protect the manager itself. Use a long, unique master password and turn on two-step verification for the password manager account.
- Let it autofill. A password manager will only fill in a password on the real website it was saved for. That gives you some protection against fake login pages.
Turn on two-step verification
Two-step verification (also called 2SV, two-factor authentication or multi-factor authentication) asks for something else after your password, such as a code from an app on your phone, a tap on a notification, or a physical security key. Even if someone has your password, they can’t log in without that second step.
The NCSC describes turning on 2-step verification as “one of the most effective ways to protect your online accounts” and recommends setting it up on all your important accounts, including those that already have strong passwords. See its guide to 2-step verification.
Start with the accounts that would hurt most if someone took them over:
- Your email accounts
- Online banking and payment services
- Your website’s admin login, hosting control panel and domain registrar
- Accounting software and anything holding customer data
- Social media accounts for the business
An authenticator app or security key is generally a stronger second step than a code sent by SMS, but SMS is still far better than nothing. When you set up two-step verification, save the backup or recovery codes in your password manager so you can still get in if you lose your phone.
Use passkeys where they are offered
A passkey is a newer way to sign in that replaces the password altogether. Instead of typing a password, you confirm it’s you with your phone or computer’s fingerprint reader, face recognition or screen-lock PIN. Your fingerprint or face never leaves your device; it only releases the passkey stored there.
The NCSC’s passkey guidance says passkeys are resistant to phishing, because there is no password to type into a fake website and nothing that can be reused elsewhere. Google, Microsoft, Apple and many other services now support them.
To start using them:
- Look in an account’s security settings for an option to “create a passkey” or “sign in with a passkey”.
- Let your device’s credential manager (the password manager built into your phone or computer) or your own password manager store it. These can back up passkeys and sync them to your other devices.
- Where a site doesn’t offer passkeys yet, keep using a strong, unique password and two-step verification, as the NCSC advises.
Check whether your passwords have leaked
Both NIST and the NCSC say passwords should be checked against lists of known leaked and common passwords. Many password managers and web browsers now do this for you and warn you when a saved password has appeared in a breach, or when you’ve used the same password in several places.
If you get a warning like this, change that password straight away, plus any other account where you used it. This is the kind of change the guidance supports: one with a clear reason behind it, rather than a change on a fixed schedule.
If your website runs on WordPress or another system you manage yourself, consider a security plugin that blocks known leaked passwords for admin users. Our guide to protecting a WordPress website from hackers covers this and other steps.
Watch out for phishing
A strong password doesn’t help if you type it into a fake page. Phishing emails and messages pretend to come from your bank, a supplier, a delivery company or a service you use, and link to a copy of its login page.
- Don’t log in through links in unexpected emails or texts. Go to the website directly or use the app.
- Be suspicious if your password manager doesn’t offer to fill in a login. It may be because the website isn’t the real one.
- No genuine service will ask you to send your password by email, phone or chat.
For more on spotting these messages, read our guide to protecting your business from phishing.
Setting password rules for your staff
If you employ people, a short written policy helps everyone follow the same approach. Based on the NIST and NCSC guidance, a sensible small business policy could say:
| Do | Don’t |
|---|---|
| Use long passwords, such as three or four random words | Insist on symbols, numbers and capitals in every password |
| Use a different password for every account | Reuse a password, even a strong one |
| Store passwords in the company’s password manager | Write passwords on sticky notes or share them in chat messages |
| Turn on two-step verification on every account that offers it | Force everyone to change passwords every few months |
| Change a password straight away if it may have been exposed | Use password hints or security questions with real answers |
| Use passkeys where they are available | Leave old staff accounts active after someone leaves |
The NCSC also suggests removing access promptly when people leave, locking accounts that are no longer used, and keeping an eye out for unusual logins. These do more for security than forced password changes.
A quick checklist
- Choose a long, unique password for your email and turn on two-step verification for it.
- Set up a password manager and protect it with a strong master password and two-step verification.
- Move your saved passwords into it, and replace any that are reused or weak.
- Turn on two-step verification for banking, website, hosting, domain and social media accounts.
- Create passkeys on the accounts that support them.
- Act on any breached-password warnings from your password manager or browser.
- Keep backups of important data in case an account is ever compromised. Our guide on never losing your data explains how.
None of these steps needs technical knowledge, and most take a few minutes per account. Together they protect you against the most common ways small business accounts are taken over.
