We ask every client to put their business passwords into a password manager. It is not about making life harder, and it is not because anyone thinks your passwords are bad. It is because of one specific problem that affects almost every small business, and a password manager is the only practical fix.

The real problem is reuse, not weakness

Most people have one or two passwords they use nearly everywhere, with a number on the end that goes up when something forces a change. That is a completely reasonable response to being asked to remember forty logins.

The trouble is that when any one of those forty sites is breached - a supplier portal, an online shop, an old forum - the email address and password end up in a list that gets traded around. Someone then tries that same pair against Microsoft 365, the bank, and the accounting system. They are not targeting you. They are working through a list. The password did not need to be weak; it only needed to be used twice.

What a password manager actually gives you

• One thing to remember. You learn a single long passphrase. The manager remembers everything else and fills it in for you.
• A different password everywhere. It generates long random ones, so a breach at one site stays at that site.
• A safe way to share. The office login for a supplier portal can be shared with the two people who need it, without it being pasted into a group chat or written on a whiteboard. You can withdraw the share later.
• A clean handover when someone leaves. You know what they had access to, and you can change it in an afternoon rather than discovering an orphaned account in two years.
• It works on the phone. Which is where half of everyone’s work happens.
• It is faster. This surprises people. Filling a login with one click beats typing, failing, and resetting.

The two objections we hear, answered

"Isn’t putting everything in one place risky?" It is a fair question. The vault is encrypted with a key derived from your passphrase, which means the provider cannot read it and neither can we - we can help you set it up, but we cannot open your vault. Add MFA on the manager itself and it is a genuinely hard target. Compare that to the current arrangement: the same password in forty places, a spreadsheet called Passwords, and a sticky note under a keyboard. One strong locked box beats forty unlocked ones.

"It will slow everyone down." There is a fortnight of adjustment while you move logins in as you use them, and after that it is quicker than what you do now. You do not have to move everything on day one.

How to start

1. Pick a strong passphrase for the manager itself. Four unrelated words is the classic advice and it works - long and memorable beats short and cryptic. Write it down once and keep it somewhere physically secure until you know it.
2. Turn on MFA for the password manager. It is the one account that protects all the others.
3. Add logins as you use them over the first couple of weeks rather than setting aside a day for it.
4. Change the important ones as you go: email, banking, accounting, payroll. Let the manager generate those.
5. Stop letting the browser save work passwords once the manager is doing the job. Two half-full sets of saved passwords is worse than one.
6. Use the sharing feature for anything shared. If a password is being sent in a Teams message or an email, it belongs in the manager instead.

Talk to us

If you want a password manager rolled out across your business, we can recommend one, set it up, import what you already have and run a short session for your staff so it actually gets used. Email admin@yougrowit.com.au and we will scope it and quote it in writing.

If you already have one and something is not working, log a ticket at portal.yougrowit.com.au or email support@yougrowit.com.au. Support hours are Monday to Friday, 8:30am to 5:30pm Melbourne time, excluding Victorian public holidays.