Password managers for small businesses: what the NCSC advises and how to roll one out

Ask a small business owner where the login for the website, the accounting package or the social media accounts lives, and you will hear a familiar range of answers: a spreadsheet, a notebook, the browser, someone's memory, or "Sam knows". A password manager is the dull but effective fix, and the National Cyber Security Centre (NCSC) has clear, free guidance on it. This post pulls that guidance together and turns it into a plan for a small team.

What a password manager does

The NCSC describes a password manager as software that stores your passwords so you do not have to remember them. You unlock it with one primary password, and it keeps the rest in one place. According to the NCSC, the benefits include:

• A different password for every service, without having to memorise them.
• Strong, unique passwords generated for you quickly.
• Autofill at login, which helps against phishing because autofill only works on the correct website.
• Synchronisation across your devices.
• Warnings if a password has appeared in a breach or leak.

The NCSC is blunt that you should never reuse passwords across accounts. That is the practical reason a manager matters: if one supplier is breached and you used the same password elsewhere, criminals can try it on your email and bank.

Built in or third party?

There are two broad choices. First party managers come from the maker of your browser or device, such as the ones built into Chrome, Safari, Edge or Firefox. The NCSC says these can take advantage of deep integration with the platform's security, and that they are the easiest option, especially if you use the same browsers or operating systems on every device. The trade-off is that browser versions often lack advanced features such as secure notes or password sharing.

Third party managers are installed separately. The NCSC says they suit people who want extra features, use a mix of devices and browsers, or want to avoid being tied to one vendor. Its advice is to choose a reputable company with a strong security track record, because long-standing providers will likely only have survived through strong attention to security. It also says the best choice is the one that meets your needs and that you find easiest to use.

The NCSC lists a few questions worth asking when you compare products: does it work across all your devices and operating systems, can you control the length and character set of generated passwords, will you pay or use a free version, and do you want extras such as easier password sharing or breach notifications. For a business, the sharing question is the big one, which we come back to below.

Protect the manager itself

Putting everything in one place sounds risky, so the setup matters. The NCSC's advice is:

• Use a strong primary password and never reuse it anywhere else. The NCSC's three random words method is a good fit: it gives the example "applenemobiro", and says to avoid common passwords, significant dates, family, pet and team names, and look-alike character swaps such as a zero for the letter o.
• Turn on two-step verification (2SV) for the manager account. The NCSC says that even if a criminal knows the primary password, they still cannot get in.
• Turn on 2SV for your email first. The NCSC calls this the first, and most important, step, and says your email password should be strong and separate from everything else.
• Back up your recovery options, such as recovery keys or trusted contacts, and keep your devices and browsers on automatic updates.

The NCSC also warns that browser-stored passwords are only as secure as your devices and accounts, and that you should never save passwords on a shared public device. On a business laptop that several people use, that point deserves a moment's thought.

Where passkeys fit

The NCSC now recommends passkeys over passwords wherever they are available. A passkey is unlocked with your face, fingerprint or PIN, and because each website has its own, it resists phishing. The NCSC cites logins up to eight times faster than a username, password and 2SV code, and says passkeys are at least as secure as 2SV with the strongest password. Where a service does not offer passkeys, the advice is a strong, unique password, ideally generated by a password manager, plus 2SV. In practice you will use both for some time, and a credential manager can hold passkeys as well as passwords.

What the wider conversation says

Advice pieces and vendor blogs overwhelmingly say a manager is a sensible small business purchase, though many are written by companies that sell one, so treat their statistics with care. Hacker News, where technical readers gather, shows steady interest in open source options like Bitwarden and in the manager built into Apple devices, alongside plenty of attention to security flaws in the tools themselves. The sensible reading is that trust matters: pick a provider with a track record and keep 2SV switched on.

A plan for a small team

The NCSC's pages are written for individuals and say little about teams, so the following is our practical suggestion rather than NCSC guidance. Use it as a checklist for this week:

• List your critical accounts: email, banking, accounting, domain registrar, website hosting, payment provider and social media.
• Pick one tool for the whole business: a business plan with shared folders means you can share a login without pasting it into a message or spreadsheet.
• Do email first: a strong separate password and 2SV on every email account.
• Move shared logins in: then change those passwords so any old copies in notebooks and chats stop working.
• Write down who has access: when someone leaves, you can remove them in one place. Our earlier post on removing access when staff leave covers the rest.
• Agree a recovery plan: make sure at least two trusted people can recover the manager if one of you is unavailable.

Expect the changeover to take a few hours spread over a week or two, and expect a little grumbling at first. Sticking with it is the hard part, not the tool.

Where it connects to your systems

If your website, ordering platform or internal tools use staff logins, it is worth asking your supplier whether they support passkeys or 2SV for those logins. If you want help tightening access to your cloud services, see our cloud and security work.

A password manager will not stop every attack, and the NCSC does not claim it will. What it does is remove the weakest habits: reused passwords, sticky notes and shared spreadsheets. For most small businesses, that is a very good return for an afternoon of effort.