One leaked password. Not every door.

A password manager remembers every password for you, so each one can be long, random and different. When one website gets breached, the stolen password doesn't open anything else. For a business, a password manager also gives you a safe place to share logins, and an easy way to see and change what someone had access to when they leave.

The National Cyber Security Centre recommends them, and once your team is set up they make day-to-day work easier, not harder.

Why password reuse is the real problem

Most people don't have weak passwords because they're careless. They have a handful of passwords they can remember and use them everywhere. That works until one of those sites is breached. Criminals take the leaked email and password and try them on Microsoft 365, banking and everything else. It's called credential stuffing, it's automated, and it's one of the most common ways into a business.

The fix isn't asking people to remember 80 unique passwords. It's giving them a tool that does the remembering.

What a business password manager gives you

• A unique password for every login. It creates strong passwords and fills them in automatically on the right website.
• Shared vaults instead of spreadsheets. Logins for the website, suppliers and social media live in a shared folder that only the right people can open. No more passwords in emails, notebooks or a spreadsheet called "passwords".
• Easy leavers. Remove someone from the business account and they lose access to everything shared with them. You can also see exactly which passwords they knew, so you know what to change. My leavers checklist covers the rest.
• A warning when something leaks. Most business password managers flag reused or weak passwords and tell you if a saved login turns up in a known breach.
• Some protection from fake sites. It only fills in a password on the real website. If it doesn't offer to fill in your login, look carefully at the address.

How to roll one out in an afternoon

1. Pick a business plan. Well-known options include 1Password, Bitwarden and Keeper. Choose a business or teams plan, not individual accounts, so the business owns the vaults and can manage users.
2. Protect it with a strong main password and MFA. The password manager becomes the key to everything, so its own login needs a long passphrase and multi-factor authentication. Many can use your Microsoft 365 sign-in.
3. Set up shared vaults first. Start with the shared logins: the website, social media, suppliers, the bank's read-only access. This is where the quick wins are.
4. Invite the team and show them once. Ten minutes is enough: install the browser extension and the phone app, save a login, fill one in. Most people are converted the first time it fills in a password for them.
5. Change the important passwords as you go. Email, banking and anything with admin rights first. Let the password manager generate the new ones.
6. Set up recovery. Make sure at least two people can manage the business account, so nobody gets locked out if one person is away.

How it helps with Cyber Essentials

Cyber Essentials expects strong, unique passwords and controlled access to accounts. A password manager, alongside MFA, covers a large part of that and makes it easy to show. You can see where else you stand with the free Cyber Essentials readiness check.

If you think a password has already been used by someone else, for example you've spotted strange sign-ins or emails you didn't send, treat it as a cyber incident. Changing the password is only the first step.

FAQ

Isn't it risky to keep every password in one place?

It's far less risky than reusing passwords. Good password managers encrypt your vault so that even the provider can't read it, and with a strong main password and MFA, it's much harder to break into than the alternative.

Can't we just use the passwords saved in our browser?

For one person it's better than reusing passwords. For a business it falls short: you can't share logins safely, you can't see who has access to what, and you can't take access away when someone leaves.

Do we still need MFA if we use a password manager?

Yes. A password manager stops reuse. MFA stops a stolen password working on its own. You want both, especially on email.