Password hygiene for small teams, without the jargon

Most account takeovers happen because of weak, reused, or stolen passwords, not because of sophisticated hacking. The fix is simple: use a password manager, turn on two-factor authentication, and never reuse passwords. If you run a small team, these three habits stop the vast majority of attacks before they start.

I am Jamie Woodruff, Technical Director at Varsuite. We build websites, software, and AI agents for UK businesses. We also manage security monitoring and testing for clients. In this article, I will explain password hygiene in plain English, with practical steps you can implement today.

What is password hygiene and why does it matter?

Password hygiene means following simple rules for creating, storing, and using passwords. Good hygiene reduces the risk of someone breaking into your accounts. It matters because a single compromised password can give an attacker access to your email, your client data, or your bank details.

Small teams are often targeted because they have fewer layers of protection than big companies. Attackers know that small teams may share passwords, use simple passwords, or ignore updates. But you do not need to be a security expert to protect yourself.

Why do attackers target small teams?

Attackers target small teams because they are easier to breach. Big companies have dedicated security staff, but small teams often do not. Attackers use automated tools to try common passwords across many accounts. If someone on your team uses "password123" or the company name, they will get in.

Another reason is that small teams might not have multi-factor authentication enabled. Without it, a stolen password is enough. Attackers also use phishing emails that look legitimate. One click on a fake login page can give them your credentials.

What are the most common password mistakes?

Here are the mistakes I see most often at small UK businesses:

• Reusing the same password across multiple sites. If one site is breached, attackers use that password everywhere else.
• Using personal information like your dog's name, your birthday, or your postcode. This is easy to guess from social media.
• Writing passwords on sticky notes or in unencrypted spreadsheets. These get lost or stolen.
• Sharing passwords via email or chat. Even internal messages can be intercepted.
• Never changing default passwords on routers, printers, or cloud services. Attackers know these defaults.

Avoid these mistakes and you remove most of the risk.

What is the best password manager for a small team?

Choose a team password manager that supports shared vaults. Popular options include 1Password, Bitwarden, and LastPass. Look for one that allows you to create separate folders or vaults for different projects or clients. It should also have a browser extension that auto-fills passwords.

Set a strong master password for each team member. That master password is the key to all their other passwords. It should be long and unique. If you need a way to remember it, use a passphrase like "GreenTigerPiano42Blue". That is harder to crack than a short password.

Most password managers have a free tier for individuals, but a paid team plan usually includes central admin controls. That lets you revoke access when someone leaves. The cost is small compared to a data breach.

How do you create a strong password you can actually remember?

Do not try to remember lots of different passwords. Let the password manager generate and store them. But you will need to remember your master password and possibly some recovery codes.

For a master password, use a passphrase of at least four random words. Add numbers or symbols if you like. Avoid famous quotes or lines from songs. The point is that it is long but memorable to you only.

For passwords that you might type once in a while, like your Wi-Fi network, generate a random one and store it. Then you never have to remember it.

What is two-factor authentication and why do you need it?

Two-factor authentication (2FA) adds a second check after you enter your password. Usually it is a code from an app on your phone, or a text message. This means even if an attacker knows your password, they cannot get in without your phone.

Enable 2FA on every service that offers it: email, banking, social media, and your cloud storage. Many UK banking apps already require it. For team tools like Google Workspace or Microsoft 365, you can enforce 2FA for all staff.

Use an authenticator app rather than text messages where possible. Text messages can be intercepted, but authenticator apps are more secure. Keep the backup codes in your password manager.

How often should you change your passwords?

The old advice was to change passwords every 90 days. That is now considered outdated. Frequent changes make people choose weaker passwords or add predictable patterns like "Password1!", "Password2!" repeated. Instead, change a password only when you suspect it might be compromised, for example after a data breach or a lost device.

Use a password manager that checks for breached passwords. Many have a feature that scans your stored passwords against known breach lists. If one shows up, change it right away.

How do you manage passwords for shared accounts?

Shared accounts, like a team social media login, are a risk. Instead of sharing the actual password, use a shared vault in your password manager. Each person gets their own login to the password manager, and the shared vault gives them access to the shared credentials. You can see who accessed what and revoke access instantly.

Avoid putting shared passwords in email or a team chat. If you must share a password outside the vault, change it as soon as possible and then update the vault.

How do you keep passwords safe when someone leaves the team?

When a team member leaves, deactivate their accounts immediately. Then change any passwords they might have known. In your password manager, revoke their access to shared vaults. Review the list of devices or sessions they might have used.

Do not just delete the person. Also check for any integrations or automated logins that used their credentials. A leftover integration is a backdoor.

What about more advanced measures like single sign-on?

Single sign-on (SSO) lets you use one login to access many tools. If you already use Google Workspace or Microsoft 365, you can enable SSO for your other software. This means a person logs in once, and their identity is trusted across apps. It reduces the number of passwords they need to remember and makes onboarding and offboarding easier.

SSO is not necessary for every small team, but it is worth considering as you grow. If you use many cloud tools, talk to your software providers about enabling SAML or OAuth. You can usually do this without much technical effort.

How does Varsuite help with password hygiene and security?

At Varsuite, we bake security into everything we build. When we create websites, e-commerce stores, or custom software, we configure secure default passwords, enforce 2FA where supported, and set up password managers for your team if you need them.

We also offer security monitoring and code scanning services. That means we watch your systems for suspicious activity and scan your code for vulnerabilities. If a password leak or a weak configuration is found, we flag it and guide you through fixing it.

Our business automation and process replacement services often include automated access controls, so you can manage who has access to what without manual spreadsheets. And our AI agents can be set up to enforce password policies and alert you to any anomalies.

Good password hygiene is not a one-off task. It is a habit. We help our clients put these habits in place so they can focus on running their business.

What practical steps should you take this week?

Here is a short checklist to implement password hygiene across your small team:

1. Choose a team password manager and install it on every device.
2. Create individual accounts for each team member, not a single shared login.
3. Enable two-factor authentication on your email and the top five tools you use.
4. Use the password manager's generator for every new password. Stop creating your own.
5. Move any shared credentials into a shared vault and delete the email or spreadsheet copies.
6. Review your current passwords for any that appear in breach lists. Change those immediately.
7. Talk to your team about phishing. Remind them that no legitimate service will ask for a password via email.
8. Check your router and other default logins. Change them if you have not already.

If you do nothing else, at least set up a password manager and turn on 2FA. That combination will stop almost all casual attacks.

Why is this more important when you use AI and automation?

If you are using AI tools or automated marketing, you are likely connecting multiple services with APIs and logins. Each connection is a potential entry point. Our data integrations and custom CRM work often involve setting up secure tokens and access controls.

An attacker who gets into your AI agent's credentials might be able to see your business data or make changes. So the same password hygiene rules apply, but with extra care around API keys and service accounts. Never embed passwords directly into code. Use environment variables or a secret manager. We always follow this practice in our software development projects.

Frequently asked questions

Should you use a password manager even for a one-person business?

Yes. Even a sole trader has multiple accounts: email, banking, social media, domain registrar, and cloud storage. A password manager stores them securely and helps you generate strong, unique passwords. It also means you are ready to scale up when you hire someone.

Is it safer to use your browser's built-in password saving?

Browsers can save passwords, but a dedicated password manager is better. It offers stronger encryption, cross-device sync, shared vaults, and breach detection. Browser features are improving, but a specialist tool gives you more control and better team features.

What should you do if you think your password has been leaked?

Immediately change that password on every site where you used it. Enable 2FA if you have not already. Check your email for any unusual sign-in activity. If financial data is involved, contact your bank. You can also use a free service like Have I Been Pwned to see if your email or phone number appears in known breaches.

How do you train staff without making it a lecture?

Keep it practical. Ask them to use the password manager for the next week. Show them how phishing emails look. Make it a team challenge, see who can identify a fake email first. Remind them that security protects them personally too, not just the company. And keep the rules simple: use the password manager, turn on 2FA, and do not share passwords in chat.

Password hygiene is not glamorous, but it is the cheapest and most effective security control you can buy. Start small, do it consistently, and you will stop most account takeovers in their tracks.

If you would like help setting up secure systems for your business, contact Varsuite. We are happy to review your current setup and suggest practical steps. Call us or message through our contact page to start the conversation.