TL;DR:
- Using a password manager with MFA and long passphrases enhances account security and eases password management.
- Length-focused passwords, especially passphrases, are more secure and memorable than complex symbol-heavy passwords.
Password management is the practice of creating, storing, and protecting passwords to safeguard digital identities from cyber threats. For South African individuals and SME owners, weak or reused passwords remain one of the most common entry points for attackers. The good news is that applying a handful of proven password management tips, centered on long unique passwords, a dedicated password manager, and multi-factor authentication (MFA), dramatically reduces your exposure without adding complexity to your daily routine.
1. Why use a password manager?
A password manager is the single most effective tool for securing your accounts. It eliminates human memory limitations by generating a unique, random password for every account you own, which means a breach on one site cannot cascade into a breach on another.
Here is what a good password manager does for you:
- Generates truly random passwords that no human would ever choose or guess.
- Stores credentials in an encrypted vault, protected by a master password only you know.
- Autofills login forms across browsers and devices, saving time and reducing errors.
- Syncs across devices, so your passwords are available on your phone, laptop, and tablet.
- Alerts you to breached credentials, so you can act before damage is done.
The primary role of a password manager is to relieve cognitive burden while using truly random passwords that humans simply cannot replicate on their own. That combination of convenience and security is why security professionals recommend them universally.
Pro Tip: Secure your password manager’s master password with a long passphrase of four or more random words, and enable MFA on the manager itself. This is your single most important account.
2. Creating strong passwords: length beats complexity
The old advice about mixing uppercase letters, numbers, and symbols is outdated. Modern guidance from the National Institute of Standards and Technology (NIST) is clear: length and uniqueness matter far more than forcing complex character combinations.
NIST SP 800-63 guidelines recommend a minimum of 15 characters, with 20 or more for sensitive accounts such as banking, email, and your password manager. Passwords should be supported up to 64 characters without truncation. A longer password is exponentially harder to crack, even without symbols.
Passphrases: the practical solution
A 4 to 5 word random passphrase is easier to remember and more secure than a shorter, symbol-heavy password. Passphrases produce higher entropy and resist brute-force attacks far better. Think “correct horse battery staple” rather than “P@ssw0rd1.”
| Approach | Example | Strength |
|---|---|---|
| Short complex password | P@ssw0rd1! | Weak: predictable patterns |
| Long random passphrase | PurpleDeskRainMango | Strong: high entropy, memorable |
| Password manager generated | xK9#mQ$2vLpR7nYw | Strongest: fully random, stored securely |
Avoid predictable substitutions like replacing “a” with “@” or “o” with “0.” Attackers account for these patterns in their cracking tools. Use a password generator inside your manager for accounts where memorisation is not needed.
3. Multi-factor authentication: your critical second layer
MFA is the most critical step after setting a strong master password. Even if an attacker steals your password, MFA blocks them from accessing your account.
The main MFA methods available are:
- Authenticator apps (such as Google Authenticator or Authy): generate time-based codes that expire every 30 seconds.
- Hardware security keys (such as YubiKey): physical devices that provide the strongest protection available.
- SMS one-time codes: better than nothing, but carry risk due to SIM swapping.
Enable MFA on every critical account: your email, banking, password manager, and any business system that holds sensitive data. For South African SMEs, this includes cloud storage, accounting software, and your website’s admin panel.
Pro Tip: App-based MFA codes are strongly preferred over SMS. SIM swapping, where an attacker convinces your mobile provider to transfer your number, can intercept SMS codes entirely. Use an authenticator app wherever the option exists.
4. How to handle password changes and breaches
Forced periodic password resets are no longer recommended unless there is verified evidence of compromise. Arbitrary rotation leads to weaker, predictable passwords as people simply increment a number or add a character to their existing password.
Change a password only when:
- A breach alert confirms your credentials were exposed.
- You suspect unauthorised access to an account.
- An employee with access to shared credentials leaves your business.
- Your password manager flags the password as weak or reused.
Checking for breached passwords using services like Have I Been Pwned helps you identify compromised credentials quickly. Most modern password managers integrate breach monitoring directly, so you receive alerts without needing to check manually.
When a breach is confirmed, change the affected password immediately, revoke any active sessions on that account, and check whether the same password was used elsewhere. Speed matters: attackers test stolen credentials within hours of a breach becoming public.
5. Password safety tips for small business owners
Individual password hygiene is one thing. Managing credentials across a team of five, fifteen, or fifty people requires a more deliberate approach. Effective password policies require technical enforcement, not just a document in a shared folder.
Here is what a practical SME password policy should include:
- Minimum password length of 15 characters for all business accounts, with 20 or more for admin and financial systems.
- Mandatory MFA on all business email accounts, cloud platforms, and any system accessible from outside the office.
- A shared business password manager with admin controls, so you can revoke access when staff leave without changing every password manually.
- No shared passwords between employees where individual accountability matters. Each person gets their own login.
- Regular breach monitoring integrated into your password manager, with alerts sent to an IT administrator or business owner.
| Policy element | Why it matters |
|---|---|
| Minimum 15-character passwords | Longer passwords resist brute-force attacks significantly better |
| MFA on all critical accounts | Blocks access even when credentials are stolen |
| Centralised password manager | Enables access revocation and audit trails |
| No password sharing | Maintains individual accountability and reduces breach spread |
| Breach monitoring alerts | Allows rapid response before attackers exploit stolen credentials |
Training employees on secure password practices is necessary, but training alone is not enough. Technical controls inside your password manager, such as enforced minimum lengths and MFA requirements, do the heavy lifting. Policy without enforcement is just paperwork.
6. Allowing autofill and paste: a small change with big impact
Here is something that surprises many business owners: blocking paste or autofill on password fields reduces security by discouraging the use of password managers. When users cannot paste a password, they tend to type shorter, simpler ones they can remember.
Allowing paste and autofill directly supports the use of longer, randomly generated passwords. If your business website or internal system blocks this functionality, it is worth raising with your developer. NIST guidance explicitly recommends allowing paste on all password fields. This is a quick technical fix with a meaningful security payoff.
For South African SMEs building or updating their websites, this is one of the website security best practices worth checking immediately. A developer can enable paste functionality in minutes, and the benefit to your users’ security is immediate.
7. Tips for password recovery: plan before you need it
Password recovery is the step most people ignore until they are locked out of a critical account. Planning ahead prevents a minor inconvenience from becoming a serious business disruption.
Follow these steps to prepare:
- Store recovery codes securely. Most services provide one-time recovery codes when you enable MFA. Save these in your password manager or print them and store them in a physically secure location.
- Use a dedicated recovery email address. Set a separate, secure email account as your recovery address for critical business accounts. Protect it with its own strong password and MFA.
- Document your master password recovery process. If you forget your password manager’s master password, recovery options vary by provider. Know your options before you need them.
- Designate a backup administrator. For business accounts, ensure at least one other trusted person has emergency access through the password manager’s emergency access feature.
- Test your recovery process annually. Confirm that recovery codes work and that your backup administrator can access what they need.
Proactive recovery planning is part of sound cybersecurity practices for any South African business. The cost of being locked out of your email or accounting system during a critical period far outweighs the 30 minutes it takes to set this up properly.
Key takeaways
Strong password management combines long unique passwords, a dedicated password manager, and MFA to protect accounts against the most common attack methods in use today.
| Point | Details |
|---|---|
| Use a password manager | Generates and stores unique random passwords, eliminating reuse and memory limitations. |
| Prioritise length over complexity | NIST recommends 15 characters minimum; passphrases of random words are both strong and memorable. |
| Enable MFA everywhere | App-based MFA blocks attackers even when your password is compromised. |
| Drop forced resets | Change passwords only when breach evidence exists; arbitrary rotation weakens security. |
| Enforce policy technically | SMEs need admin controls and breach monitoring, not just written policies. |
My honest take on password habits
Most people I speak to know they should use better passwords. The gap is not knowledge. It is friction. Switching to a password manager feels like a big project, so it gets postponed indefinitely.
Here is what I have found actually works: start with your three most critical accounts. Your email, your banking login, and your business admin account. Move those into a password manager, generate new strong passwords, and enable MFA. That alone puts you ahead of the majority of users and businesses.
The shift from complexity rules to length focus is one of the most underappreciated changes in modern security guidance. Adoption of modern password standards is slow, but transitioning to length-focused policies greatly improves both security and user compliance. People are far more likely to use a 20-character passphrase they can actually type than a 10-character symbol soup they keep forgetting.
For SME owners, the business case is straightforward. A single compromised admin account can expose your client data, your financial records, and your reputation. The cost of a password manager for your team is negligible compared to the cost of a breach. Get the technical controls in place, and the policy follows naturally.
— Anton
Secure digital solutions built for South African businesses
At Cloudfusion, we build websites and digital systems with security as a foundation, not an afterthought. That means implementing proper authentication flows, supporting password manager autofill, and advising clients on access control from day one. If your current website or business system was built without these considerations, it may be exposing you to unnecessary risk.
Our custom web development work covers everything from secure login systems to MFA integration and admin access controls tailored to your team’s structure. We also offer secure web hosting environments designed to protect your data and your users. Give us a shout if you want to chat about how your digital setup measures up, and what it would take to bring it up to current standards.
FAQ
What is the safest way to store passwords?
A dedicated password manager with strong encryption is the safest way to store passwords. It generates unique passwords for every account and protects them behind a single master password and MFA.
How long should a password be?
NIST recommends a minimum of 15 characters for standard accounts and 20 or more for sensitive accounts like banking and email.
Is SMS two-factor authentication safe enough?
SMS-based MFA is better than no MFA, but app-based authenticators like Google Authenticator or Authy are significantly safer. SMS codes are vulnerable to SIM swapping attacks.
How often should I change my passwords?
Change a password only when there is evidence of a breach or compromise. Forced periodic resets are no longer recommended, as they typically lead to weaker, predictable passwords.
What should a small business password policy include?
A practical SME policy requires a minimum password length of 15 characters, mandatory MFA on all critical accounts, a centralised password manager with admin controls, and integrated breach monitoring.
Recommended
