Complete Guide to Strong Passwords and Authentication
Most cyber attacks on small businesses start with a login: a guessed password, a reused one, or one handed over on a fake login page. The good news is that fixing passwords is cheap and quick. Here is what actually works in 2026, in plain English.
Use passphrases, not passwords
Long beats complicated. A string of four or more random words, such as copper kettle running lantern, is far harder to crack than P@ssw0rd1!, and much easier to remember. The Australian Cyber Security Centre recommends passphrases like this for passwords you have to remember.
- Use four or more random, unrelated words.
- Avoid song lyrics, quotes, names and anything about you that is on social media.
- Use a different passphrase for each important account.
Never reuse passwords
When a website is breached, attackers try the stolen email and password combinations on other sites, including Microsoft 365, banking and accounting systems. If you reuse passwords, one breach anywhere opens doors everywhere.
Let a password manager do the remembering
You can’t remember a unique password for every account, and you don’t need to. A password manager creates long random passwords, stores them securely and fills them in. You only remember one strong passphrase for the manager itself. For teams, read how to share passwords securely with employees.
Even a strong password can be stolen by a convincing fake login page, so pair it with multi-factor authentication. Our small business guide to MFA covers how to roll it out.
Passkeys: the future of logging in
Passkeys replace passwords with a secure key stored on your phone or computer, unlocked with your fingerprint, face or PIN. They can’t be phished or reused, and Microsoft, Google and Apple all support them. Where a service offers passkeys, turn them on.
Old advice you can stop following
- Changing passwords every 90 days. Forced changes lead to weak, predictable passwords. Change a password when there is a reason to, such as a breach, a staff member leaving or a suspicious login.
- Complicated character rules. Length matters more than symbols.
- Security questions with real answers. Your mother’s maiden name is easy to find. If a site forces these, store made-up answers in your password manager.
A quick checklist for business owners
- MFA on every email account, with no exceptions
- A business password manager for the team
- No shared logins where individual accounts are possible
- Passwords changed and access removed when someone leaves
- Staff know how to spot fake login pages and report them
These steps line up with the ASD Essential Eight and the questions most cyber insurers now ask.
How attackers actually get passwords
Knowing how passwords are stolen makes it easier to see why these rules matter:
- Credential stuffing: email and password pairs from old data breaches are tried automatically on business systems.
- Phishing: a fake Microsoft 365 or courier login page collects whatever is typed into it.
- Info-stealer malware: malicious downloads quietly copy every password saved in the browser. Read about malware threats to watch for.
- Password spraying: a handful of common passwords are tried against every account in your business. See what password spraying is and how to stop it.
- Guessing: names, birthdays, pets and sports teams found on social media.
Check whether your details have been exposed
Have I Been Pwned, a free service created by Australian security researcher Troy Hunt, lets you check whether an email address has appeared in known data breaches. Many business password managers also alert you when a saved password shows up in a breach. If your details appear, change the password on that site and anywhere else you used it, and make sure MFA is turned on. Our article on whether data can be removed from the dark web explains what else to do.
Setting a password policy for your team
A short written policy keeps everyone on the same page. A good starting point:
- Passphrases of four or more random words for anything staff have to type themselves
- A unique password for every business account, with no reuse
- The business password manager is required for all work logins
- MFA on every account that supports it
- Passwords are changed when there is evidence of compromise, not on a fixed timer
- Common and easily guessed passwords are blocked, which Microsoft Entra password protection can do automatically
Common questions
Is it safe to save passwords in my web browser?
It is better than reusing the same password everywhere, but browser password stores are a favourite target for info-stealer malware, and the business has no control over what is saved or who can see it. A business password manager adds secure sharing, central control and the ability to remove access when someone leaves.
How long should a password be?
Longer is better. For anything you type yourself, a passphrase of four or more random words is a good minimum. For everything else, let your password manager generate long random passwords that you never need to remember.
Can we use passkeys for business accounts?
Increasingly, yes. Microsoft 365 supports passkeys through the Microsoft Authenticator app and security keys, and many other business services now support them. Start with administrator accounts, where the extra protection matters most, then roll them out more widely.
Want password managers and MFA set up across your team? See our managed IT security services.
Want to know how exposed your logins are?
Our free cyber risk scan checks for leaked business passwords and common weaknesses, and explains what to fix first.
Or call 1300 133 770.
