Most small business data breaches don’t start with a sophisticated hacker. They start with a password.
Specifically: a password that was reused across multiple accounts, written on a sticky note, or just not strong enough to survive a basic guessing attack. If your business email, QuickBooks, and Stripe all share the same password, one breach exposes all three.
The fix is a password manager. It takes about 30 minutes to set up and it solves most of this problem automatically.
What a Password Manager Does
A password manager stores all your passwords in an encrypted vault. You remember one master password — the app handles the rest. It generates strong, unique passwords for every account, fills them in automatically, and keeps them synced across your phone and computer.
The result: every account gets a different 20-character random password, and you don’t have to remember any of them except the one to open the vault.
Which One to Use
For most small businesses, one of these three works well:
1Password (plans start around $3/user/month) is the easiest to use and has solid business features if you have employees to share passwords with. Good choice if you want to share credentials with a team.
Bitwarden has a generous free tier and is open source, which means its security has been reviewed by independent researchers. For a solo operator, the free version is completely sufficient.
Apple Passwords (built into iPhone and Mac since iOS 18) works fine if everyone in your business uses Apple devices. It’s now a standalone app with more features than the old Keychain — including shared password vaults for families or small teams. The price is right (free) but it’s limited outside the Apple ecosystem.
Getting Started
The setup process is similar for all of them:
- Create an account and install the browser extension and phone app.
- Start with your most important accounts: business email, banking, accounting software, and anywhere you take payments.
- For each one, let the password manager generate a new, strong password and save it.
- Turn on two-factor authentication anywhere it’s available (this is a separate layer of protection — more on that below).
You don’t have to migrate everything at once. Start with the accounts that would hurt the most if compromised, then work through the rest over a few weeks.
Two-Factor Authentication
While you’re at it: enable two-factor authentication (2FA) on your business email. This means even if someone gets your password, they also need a code from your phone to log in. It’s the single most effective thing you can do to protect your email account, and it takes about five minutes to set up.
Gmail, Microsoft 365, and most major services support this. Look for it in your account security settings.
A Note on Passkeys
You may start seeing “passkey” as a login option on Google, Apple, and other services. Passkeys replace passwords entirely with a secure key stored on your device — you log in with Face ID or your fingerprint instead. They’re more secure and harder to phish than passwords. Your password manager handles these too, so you don’t need to do anything special.
The 30-Minute Version
- Download Bitwarden (free) or 1Password (trial)
- Install the browser extension
- Save your top 5 accounts with new, generated passwords
- Enable 2FA on your business email
That’s it. You’ve just done more than most small businesses ever do for security.
Want help setting this up for your business? I offer one-on-one sessions in person (South Bay) and remotely. Schedule a session.
