Passwords are one of those topics where everyone quietly suspects they are doing it wrong, and almost nobody enjoys talking about it. So let us take the judgment out of it right away. The habits most teams have around passwords are the habits the tools of the past trained them into. Remembering passwords, reusing passwords, sharing the website login in a chat message: these are all natural responses to a system that asked people to do something human memory is genuinely bad at.
The good news is that the fix is not discipline. It is a small set of habits that, once in place, are less work than the old way, not more. These are the ones we recommend to every team we support, and the same ones we follow ourselves.
Let a password manager do the remembering
The single biggest upgrade a team can make is to stop remembering passwords at all. A password manager is a small application that stores all your logins in an encrypted vault, fills them in for you, and syncs across your devices. You remember one strong passphrase. The manager remembers everything else.
This solves the root problem behind almost every password bad habit. Reuse happens because nobody can remember dozens of unique passwords. Weak passwords happen because memorable and strong pull in opposite directions. Once memory is out of the equation, every account can have a long, unique, random password at no daily cost. Most managers offer team plans with shared vaults, a feature that matters for a reason we will get to shortly. Whichever product you choose, the habit is the same: if a password is worth having, it goes in the vault, and nowhere else.
Never invent a password again
People are famously bad at inventing random passwords. Whatever we come up with tends to follow patterns, and patterns are exactly what guessing software is built to exploit. Generated passwords sidestep the problem completely: a long string of random characters, created by the tool, stored by the tool, typed by the tool. Nobody ever needs to see it, let alone memorize it.
We lean into this in our own products. When our client portal or any of our tools asks you to set a password, it offers a strong generated one by default, so the path of least resistance is also the safe one. Nobody has to be creative on the spot, which is good, because creativity on the spot is how a pet name and a birth year end up guarding the company website. Accept the generated password, let the manager store it, and move on with your day.
One person, one account
Shared logins are common because they are convenient. One editor account for the website, one login for the newsletter tool, everyone in the same statistics dashboard. The convenience is real, but so are the costs, and they surface at the worst times. When everyone is the same user, you cannot tell who changed what, which turns small mysteries into long investigations. When the password changes, everyone is locked out at once. And when someone leaves the team, you cannot remove just their access, so in practice the password quietly never changes at all.
One account per person fixes all of this, and on the systems we build it costs nothing. Adding an editor to a Drupal site takes moments, and each account carries exactly the permissions that person needs, no more. Where a third-party service prices per seat and nudges you toward sharing, treat that as a question worth raising rather than a fact of life. And for the credentials that genuinely are shared, like the company social media accounts, a shared vault in the password manager does the job the sticky note used to do, minus the sticky note.
Turn on 2FA where it counts
Two-factor authentication means a login needs something extra beyond the password, usually a code from your phone. It is the seatbelt of account security: mildly annoying for a few days, then invisible, then one day very important. If a password does leak, and leaks happen to careful people too, 2FA is what stands between a leaked password and a taken-over account.
You do not need it on everything by Friday. Start where the stakes are highest: email first, because whoever controls an inbox can reset most other passwords from it. Then the accounts that hold money or send messages in your name, then the website admin accounts, then the domain and DNS. Prefer an authenticator app over text message codes where you have the choice. Password managers can store these codes too, right next to the password, which keeps the whole ritual down to a couple of seconds.
One practical footnote: when you enable 2FA, the service usually offers recovery codes for the day your phone is lost or replaced. Store them in the vault as well. The point of a second factor is to keep strangers out of your accounts, not to lock you out of your own.
Have a calm plan for departures
People leave teams, on good terms and occasionally on bad ones, and their access should leave with them. The teams that handle this smoothly are not the most suspicious ones. They are the ones with a short checklist written down before it was needed. Disable or remove the accounts that belonged to the person. Rotate the genuinely shared credentials they had access to, which the password manager turns into a ten-minute job instead of an archaeology project. Check the quiet access paths: email forwarding rules, connected apps, saved API keys, the domain registrar.
If the earlier habits are in place, this list stays short and boring, which is exactly what a departure should be. One account per person means removal is surgical. The vault means you know what was shared. 2FA means an old password that escaped rotation is not a master key. None of it requires drama, and none of it implies distrust. It is the same courtesy as collecting the office keys.
Good habits are easier than they sound
None of this needs a security background or a meaningful budget. A password manager, generated passwords, individual accounts, 2FA on the accounts that matter, and a departure checklist: each is roughly an afternoon to set up, and together they remove most of the everyday credential risk a small team carries. Better still, they remove effort rather than adding it. No more forgotten-password loops, no more asking a colleague for the login, no more wondering who still has the keys.
Set up once, these habits fade into the background and quietly work, which is the best thing security can do. Start with the password manager this week. The rest follows more easily than you expect.