Day-to-day tools
Passwords and security
How should you protect your business accounts, and do you need a password manager?
Six short steps. No email or account.
- Who needs it
- Any business with more than one person, and every business holding customer payment details.
- When it matters
- Before the second person gets a login to anything that matters. Once a password has been shared over text it cannot be un-shared, and revoking access when someone leaves becomes guesswork rather than a single action.
- Compare first
- Sharing model
- Matters most when
- growing, mature
Is this the right tool for you?
Small businesses run on dozens of online accounts: the bank, payroll, email, suppliers, the website, social profiles. When logins are shared by text, reused, or known only to the owner, a single stolen password or departing employee can mean lost money, a locked-out account or a hijacked email used to send fake invoices.
Signs you need it now
- Logins are shared by text, email or a note on the office wall.
- The same password is used for several accounts, including banking or payroll.
- Only one person knows the passwords to accounts the business depends on.
- You cannot say who still has access after someone left.
- Your email or bank account does not require a second step to log in.
When another area fits better
- You also need business email accounts and shared files under your control. Read the email and file storage guide
Recognise two or more of these? Sort out passwords and security next.
Tell us how your business runs and get a plan that puts passwords and security in order with everything else: what to set up first, your must-haves and what to compare.
What matters at your size
Working alone
A password manager, unique passwords everywhere, and two-step login on email, banking and payment accounts. Write down how someone you trust could get in if you could not.
A small team
A business password manager with shared vaults, so staff use logins without seeing or texting them, and access can be removed in one place when someone leaves.
Several teams or locations
Single sign-on where your tools support it, enforced two-step login, managed devices, regular access reviews, and outside help for security settings and training.
How the way you work changes the choice
- Crews sharing phones or tablets
- Shared devices need their own lock codes and should stay signed into only what the crew needs. Keep banking and payroll off shared devices entirely.
- Small offices
- Email is the main target, and fake payment requests are the main risk. Protect email first, and confirm any change to bank details by phone on a known number.
- Shops and front counters
- Staff should each have their own point-of-sale and system logins, not one shared code, so you can see who did what and remove access cleanly.
What to compare
Sharing model
Sharing without revealing the password, and revoking instantly, is the core feature.
Recovery
Understand what happens if the owner loses access. Some models cannot recover it at all.
Adoption
If it is awkward on a phone, the crew will go back to texting passwords.
Cost and setup effort
- Business password managers are usually priced per user. The cost is small next to the cost of a single compromised bank or email account.
- Setup means gathering every login into the manager, changing weak or reused passwords, and turning on two-step login. Start with money and email, then work down the list.
- Plan for recovery: make sure more than one trusted person can reach critical accounts, and store recovery codes somewhere safe.
Trade-offs to weigh
- Convenience or control
- Browser-saved passwords are easy but tie logins to one person and one device. A business password manager takes a little adjusting but lets you share and revoke access properly.
- Two-step methods
- Text-message codes are better than nothing. Authenticator apps or security keys are stronger, especially for email and banking.
- Do it yourself or get help
- The basics are manageable for any owner. Once you have staff devices, customer data or payment systems to secure, a periodic review by an IT provider is worth it.
When to sort it out
Before the second person gets a login to anything that matters. Once a password has been shared over text it cannot be un-shared, and revoking access when someone leaves becomes guesswork rather than a single action.
Your next step
Answer six short questions about how your business runs. You get an operating plan: where passwords and security fits among your priorities, the must-haves to hold every option to, and what to compare when you choose.
Where this comes first
Trades and businesses that usually sort this out early.
Often decided alongside
Other parts of day-to-day tools.