Password rules for staff that actually work

Why the old rules backfired

For years, businesses required passwords with an uppercase letter, a number and a symbol, changed every 30 or 90 days. The intention was good, but people responded predictably. Summer2024! became Autumn2024!, then Winter2024!. Passwords got harder to remember and easier to guess, and more of them ended up on sticky notes under keyboards. Security agencies in several countries have since changed their advice. The emphasis is now on length, uniqueness and checking passwords against known breaches, rather than complexity rules and fixed expiry. Many organisations still run the old policy simply because nobody has revisited it.

Forced expiry also creates a support burden. Every change cycle brings a wave of locked accounts, forgotten passwords and calls to whoever handles IT, often first thing on a Monday. Staff who are constantly inventing new passwords stop thinking about them as security at all and start treating them as an annoying chore to get through as quickly as possible, which is the opposite of what you want.

Length beats complexity

A password's strength comes mostly from its length and unpredictability. A passphrase of four or five random words, such as kettle orbit planet maple, is far harder to crack than a short jumble like Tr0ub!e7, and much easier to remember and type. The words need to be genuinely random, not a famous quote, song lyric or something about your life that people could look up. For passwords staff need to remember, such as the computer login and the password manager's master password, a passphrase is the right choice. For everything else, let the password manager generate a long random password that nobody needs to remember at all.

Never reuse a password

Reuse is the single biggest password weakness in small businesses. When a website is breached, attackers try the stolen email and password combinations on email providers, Microsoft 365, banks and other popular services. If a staff member used the same password for a hobby forum and their work account, the attacker walks straight in. Make no-reuse an explicit rule, explained in plain terms, and give people the tool to make it possible: a password manager. Telling staff not to reuse passwords without giving them a way to manage dozens of unique ones simply doesn't work.

Check against known breached passwords

Some systems can block passwords that appear on lists of commonly used or previously breached passwords. Microsoft Entra ID, which sits behind Microsoft 365, includes password protection features that ban common and easily guessed passwords, and you can add your own banned words such as the company name or suburb. Check which options your licence includes. Password managers often include a breach-monitoring feature that warns when a saved password appears in a known breach. That turns a vague worry into a specific task: change this one password today.

When passwords should be changed

Change a password when there's a reason: it might have been seen or typed into a phishing page, the account showed suspicious activity, the service reported a breach, someone who knew it has left, or it was shared in an insecure way. In those cases, change it promptly, from a trusted device. Without a reason, regular forced changes add little and encourage weak patterns. If you're required to rotate passwords for insurance or compliance, a password manager makes it painless, and long random passwords mean each change is genuinely new rather than a slight variation on the last.

Passwords are only half the protection

Even a perfect password can be stolen through phishing or malware. That's why multi-factor sign-in matters so much: it means a stolen password alone isn't enough. For any account that matters, especially email, Microsoft 365, banking and accounting, multi-factor sign-in should be required, not optional. Many organisations are also moving toward passkeys and sign-in with Microsoft or Google accounts, which reduces the number of passwords staff handle. The fewer passwords people have to manage, the fewer opportunities there are to get one wrong.

A simple written policy

Your password policy doesn't need to be long. A one-page document can say: use a passphrase of at least four random words for passwords you need to remember; use the company password manager for everything else; never reuse passwords; never share passwords by email or chat; turn on multi-factor sign-in wherever it's offered; and report any password you think may be exposed. Explain the reasons behind each rule in a sentence. People follow rules they understand much more consistently than rules they see as box-ticking. Review the policy once a year, and when your systems change.