No. Using one password everywhere means that when any single website is broken into, every other account you own is open as well. The password on your business email matters most, because whoever controls that mailbox can reset the rest. A password manager and multi factor authentication fix the problem with far less effort than most people expect.

Why one password is a problem

Websites get breached all the time. A shop you bought from once, a forum, an old booking site. When that happens, the list of email addresses and passwords is sold or posted online. Criminals then feed that list into software that tries every pair against banking sites, cloud storage, social media and business email, automatically, thousands at a time. This is called credential stuffing, and it is the most common way small business accounts are taken over. Nobody guessed your password. They reused the one you reused.

Why the email password matters most

Think about what happens when you click Forgot Password on almost any service. A reset link is sent to your email. So whoever can read your business email can reset your accounting software, your website, your social media and your domain name, one after the other. They can also read your invoices and send a convincing message asking a customer to pay into a new account. If you change only one password this week, change that one.

The practical answer for a small business

Nobody can remember forty strong passwords, and nobody should try. A password manager does the remembering for you. You learn one long master passphrase, four or five unrelated words strung together, and the manager generates and stores a different random password for every other service. It fills them in when you sign in, so day to day it is actually faster than typing.

For a business with staff, the useful feature is shared vaults. Passwords for shared accounts, such as social media pages or supplier portals, sit in a vault the right people can use without ever seeing the password itself. When someone leaves, you remove their access and change the handful of shared passwords. No sticky notes, no spreadsheet called passwords.

Add a backstop

Even a unique password can be stolen by a convincing fake login page. Multi factor authentication, sometimes called two factor or MFA, means a password alone is not enough to sign in. A code or approval on your phone is needed as well. It stops most account takeovers outright and belongs on every account that offers it, starting with email. Our guide to setting up Microsoft Authenticator walks through the Microsoft 365 version step by step.

What to do next

Today, do these three things.

Check the password on your business email. If it is used anywhere else, or is shorter than about fourteen characters, change it to a long passphrase you have never used before.
Turn on multi factor authentication for email, then for banking, accounting and social media.
Pick a password manager, set it up on your computer and phone, and save passwords as you sign in over the next couple of weeks. Change the weak or reused ones as you go.

If you would rather have someone check every account in the business and set it up properly for staff, that is part of what we do under cyber security for Perth businesses.

Is a password manager safe if it holds all my passwords in one place?
Yes, provided the master passphrase is long and multi factor authentication is turned on for the manager itself. The vault is encrypted, so even the company that runs it cannot read your passwords.

What makes a password long enough?
Length beats complexity. A passphrase of four or five unrelated words, around twenty characters, is far stronger than eight characters of symbols and easier to type.

How do I know if my password has already been leaked?
Most password managers compare your saved passwords against known breach lists and flag the ones to change. Treat any flagged password as already public.

If this is happening in your business and you would like it sorted, call DM1 on (08) 6202 6012 or send us a message. We look after IT, Microsoft 365, websites and domain names for Perth small businesses.