Password Ideas for Business

Business accounts are linked together. A single weak password on an email, Slack, Google Workspace, Microsoft 365 or GitHub account can give an attacker access to customer data, invoices and internal files, and business email compromise, where criminals use a real mailbox to request payments, is one of the most costly forms of cybercrime. Attackers know that one reused or guessable password inside a company is often enough.

Every person should have their own login with a unique random password of at least 16 characters, generated and stored in a team password manager. When a login truly has to be shared, share it through the password manager rather than by email or chat, so access can be removed later. Keep administrator accounts separate from everyday accounts and protect them with the strongest options available, such as passkeys or security keys.

Current NIST guidance (SP 800-63B) advises against forcing staff to change passwords on a fixed schedule, which mostly leads to predictable variations. Instead, require two-factor authentication or single sign-on, check passwords against known breach lists, and change credentials immediately when someone leaves the team or a compromise is suspected.