What a password manager fixes, how to choose one, and the setup that keeps it safe.
Resources / Should my small business use a password manager?
Yes. The Australian Signals Directorate's advice to small businesses is to use a password manager to create and store a unique password for each important account. It fixes the habits that cause most account break-ins: reused passwords, weak ones, and passwords kept in a notebook, a spreadsheet or a phone's notes app. Protect it with a long passphrase and multi-factor sign-in, and it is far safer than anything you are doing now.
Master passphrase to remember, instead of dozens of passwords
In the passphrase ASD recommends for your master login
Lost by one person who kept their passwords in a phone notes app
Most small businesses run on a few dozen logins: email, banking, accounting software, the website, supplier portals, social media, the phone system. Nobody can remember a strong, different password for each, so people reuse one or two, write them down, or keep them in a spreadsheet.
Reuse is the real danger. When one website is breached, criminals try the same email and password everywhere else, and a reused password opens every door it was used on.
A password manager removes the reason to reuse. It creates a strong, unique password for each account, stores it, and fills it in for you, so you only remember one master login. The Australian Signals Directorate's small business guide puts it simply: use a password manager to create and store unique passwords for each of your important accounts.3
It is a fair worry, and ASD addresses it directly: password managers are attractive targets for criminals, so use a reputable one and secure it properly.1 The question is what you are comparing it with.
ASD gives the example of a woman who kept all her passwords in her phone's notes app. She lost the phone while it was unlocked, and by the next day criminals had moved almost $4,000 out of her accounts.1 A notes app, a spreadsheet or a notebook has none of a password manager's protection.
A good password manager encrypts everything, so nothing can be read without the master login, and can require a second step to unlock it.1 That is a much higher wall than most businesses have around their passwords today.
One thing to check: ASD notes that some providers, such as banks, may not cover losses if you store your password for them in a password manager.1 Read your bank's terms, and if in doubt keep that one login out of it and protect it with multi-factor sign-in.
ASD's checklist is a good starting point. Pick a company and product with a good reputation and regular updates, with encryption, multi-factor authentication to unlock the vault, syncing across your devices, alerts when one of your passwords turns up in a data breach, and browser extensions that fill in logins for you.1
For a business, add two more requirements. First, shared vaults: a way to share the logins a team genuinely shares, such as the supplier portal, without sending the password around by email or text. Second, the account belongs to the business, with an owner or manager who can add and remove people.
That second point is what makes staff changes easy. When someone leaves, you remove them from the password manager and change the shared passwords they could see. ASD's point about shared accounts applies here: unless the password changes, people can keep using an account after they have left the business.3
The master login is everything, so make it a passphrase: four or more random words, like the example ASD uses, "crystal onion clay pretzel".2 Do not use it anywhere else, do not include personal details, and never save it in your browser.
Turn on multi-factor authentication for the password manager itself. Set your computer and phone to lock after a short time, ASD suggests something like five minutes.1 If the password manager has a "remember me" option, do not use it on shared or public devices.
Then move your accounts across, most important first: email, banking, accounting software, your domain provider and Microsoft 365 or Google admin. For each one, let the password manager generate a new password, change it on the account, and turn on multi-factor sign-in while you are there.1
When everything is across, retire the old system properly. Delete the password spreadsheet from your computer, your email and any shared drive it was ever saved to, and shred the notebook. Old lists are worth more to a criminal than you might think, because they often still hold the passwords for accounts nobody remembered to move. Give the team a week, then ask everyone whether anything is still living outside the password manager.
A password manager is not the whole answer. Multi-factor authentication on email and banking matters more than any single tool, because it stops a stolen password from being enough on its own.
But the two work together. The password manager makes every password strong and different, and multi-factor sign-in covers the day one of them leaks anyway. Our Essential Eight guide explains how both fit into the security baseline that Australian insurers and larger clients increasingly ask small businesses about.
Not sure how strong your current passwords are? Our free Password Strength Checker shows how long a password would take to crack. It runs in your browser, so the password is never sent anywhere. Try a few made-up examples in the style your team uses, never a real one, and you will quickly see why letting a password manager generate them is the easier path.
Essential Eight for small business: the 2026 transition guide: The security baseline insurers and clients ask about, and what is changing.
Free Password Strength Checker: See how long a password would take to crack, without sending it anywhere.
Our IT person is leaving. What do we need from them before they go?: Shared passwords, admin access and backups: the handover list.
Yes. The Australian Signals Directorate's small business guide says to use a password manager to create and store unique passwords for each of your important accounts, and to protect it with a strong passphrase and multi-factor authentication.
Much safer. A password manager encrypts what it stores and can require a second step to unlock it. A spreadsheet, notebook or phone notes app can be read by anyone who gets hold of it.
That is why the master login matters. Use a long passphrase you use nowhere else, turn on multi-factor authentication, choose a reputable product that encrypts your vault, and lock your devices when you step away.
Shared logins live in the business's password manager instead of in people's heads. When someone leaves, you remove their access and change the shared passwords they could see.
Check your bank's terms first. ASD notes some providers, such as banks, may not cover losses if you store their password in a password manager. If in doubt, keep that login out and protect it with multi-factor sign-in.
Tell us how many people you have and how you share logins today. We will suggest a setup that fits, and help you move your most important accounts across safely. Free 30-minute call, no obligation.
Prefer to talk? Call (02) 9053 8789.
Belivanis Information Systems