The real problems
- Reuse. When one website is breached, criminals try the same email and password everywhere else.
- Shared logins that never change when people leave.
- Passwords in spreadsheets, notebooks and chats.
- Forced regular changes, which push people towards predictable patterns (Summer2026!, Autumn2026!).
What good looks like
- Use a business password manager. Every account gets a unique, strong password; staff only remember one. Shared vaults handle team logins safely and can be revoked when someone leaves.
- Three random words for the passwords people do need to remember: the NCSC's advice for passwords that are strong and memorable (e.g. kettle-orbit-ferns, but not that one).
- MFA everywhere, so a leaked password alone isn't enough. See our MFA guide.
- Stop forced expiry unless a password is known to be compromised. Change it when there's a reason.
- Use passkeys where services support them; there's no password to steal.
Leavers: the forgotten risk
When someone leaves, their access often doesn't. Keep a list of every system each role uses, disable accounts on the last day, and rotate any shared passwords they knew. A password manager makes this a five-minute job instead of a guessing game.
