Most people know their passwords are not great. They use the same one in too many places, it is too short, and it probably includes a birthday or a pet's name. The problem is that knowing this and actually fixing it are two different things.
Here is a practical approach to creating strong passwords that you can actually use day to day.
Why it matters
Weak passwords are involved in the majority of business data breaches. Attackers do not need to be sophisticated. They use automated tools that try millions of common passwords in seconds. If yours is "Company2024!" or "Welcome123", it will be cracked almost instantly.
Once someone has your password, they have access to everything that account touches. Your email, your files, your client data, your financial systems. For a business, one compromised password can lead to stolen funds, data breaches and serious reputational damage.
What makes a password strong
A strong password has three qualities. It is long, it is unique, and it is not predictable.
Length matters more than complexity. A password like "correct-horse-battery-staple" is actually harder to crack than "P@ssw0rd!" because of its length, even though the second one looks more complex. Aim for at least 14 characters.
Unique means you never reuse a password across different accounts. If one service gets breached and your password is leaked, attackers will immediately try that same password on your email, your bank and everything else. Using a different password for every account limits the damage to that one account.
Not predictable means avoiding things that anyone could guess or find out about you. Your company name, your surname, the current year, your child's name, your favourite sports team. If it appears on your social media profile, it should not appear in your password.
A simple method that works
Think of a short phrase or sentence that means something to you but would not be obvious to anyone else. Then use the first letter of each word, mix in a number and a symbol, and you have a strong password.
For example, "I walked my dog on Camps Bay beach every Saturday" becomes "IwmdoCBbeS" and then add a number and symbol to get something like "IwmdoCBbeS!47". That is 14 characters, mixed case, includes a symbol and a number, and is easy for you to recall because you know the sentence behind it.
Another approach is to pick three or four random words and string them together with a separator. Something like "invoice-harbour-Tuesday-lamp" is long, random and surprisingly easy to remember after a few uses.
Use a password manager
The honest reality is that nobody can remember a unique 14-character password for every account they use. That is where a password manager comes in.
A password manager is a secure app that stores all your passwords in an encrypted vault. You only need to remember one master password to unlock it. The password manager generates strong, random passwords for every account and fills them in automatically when you sign in. If you need a strong password right now, use our free password generator.
Microsoft 365 business accounts work well with Microsoft Authenticator, which can also store and autofill passwords. There are also dedicated password managers like 1Password and Bitwarden that work across all devices and browsers.
Always enable multi-factor authentication
Even a strong password is not enough on its own. Multi-factor authentication, often called MFA or two-factor authentication, adds a second step when you sign in. After entering your password, you confirm the login on your phone or enter a code from an authenticator app.
This means that even if someone steals your password, they cannot get into your account without also having your phone. It is the single most effective thing you can do to protect your business accounts.
If you are using Microsoft 365, MFA should be enabled on every user account. If it is not, that is something to sort out immediately.
When to get help
If you are not sure whether your team's passwords are strong enough, if MFA is not set up across your business accounts, or if you have had a security scare and want to make sure your accounts are locked down, Recloud can help. We set up password policies, enable MFA and configure password managers for businesses so that security is built into how your team works every day.