Employee passwords: bringing order without the pain

A shared "passwords.xlsx" in a network folder, a sticky note under the accountant's keyboard, a single admin panel password that everyone knows and that has not changed since the site launched. This is not a caricature but the typical picture in a company of under thirty people. The good news: it can be sorted out in a week and almost for free.

Why the old-school requirements do not work

The demand for "eight characters, a digit, a special character, changed every 90 days" produced a well-known result: Password1!, then Password2!, then a sticky note on the monitor. Modern recommendations, including the updated NIST standards, have reversed course completely: length matters more than complexity, forced rotation without signs of compromise does harm, and the crucial step is checking the password against known breach databases. A passphrase of four random words, 20+ characters long, is easier to remember and takes orders of magnitude longer to crack than Qw3rty!2.

A password manager: the foundation of order

One tool solves most of the problem. The employee remembers a single master password; everything else is generated randomly and stored encrypted. The side effect matters more than the main one: a manager will not autofill saved credentials on a phishing site, because the domain does not match. A human makes that mistake, software does not. Corporate editions add shared vaults per department, usage auditing and instant access revocation when someone leaves.

A five-step rollout

• Inventory: write down every service where the company has an account. The list usually turns out twice as long as expected.
• Assign an owner to each service — a specific person, not a department.
• Deploy the password manager and set up shared vaults by department.
• Replace passwords on critical services with generated ones, starting with email, the domain and hosting.
• Enable two-factor authentication everywhere it is available — a detailed guide here.

A separate headache: shared accounts

One administrator account for five people is not just a risk but an investigative dead end: the log will show that "admin" performed the action, and that is where it ends. The right answer is individual accounts with differing privilege levels. Where a service genuinely does not support multiple users (and this happens with older systems), the shared password lives in a vault with an access log and is changed whenever the team composition changes. When designing SaaS platforms we build individual accounts with roles in from day one — retrofitting this later costs many times more.

What to do about service passwords

Database passwords, API keys and integration tokens live in configuration, not in people's heads. The main rule: they never go into the code repository — not even a private one, not even "temporarily". A secret that has once entered git history is public forever, and deleting the commit does not help. A secrets store or encrypted environment variables are the minimum standard. On securely handling credentials in browser applications, the MDN documentation is worth reading.

A policy people will actually follow

• A minimum length of 12 characters, with no mandatory special characters — length beats character variety.
• Checking each new password against breach databases when it is set.
• Changing passwords only on suspicion of compromise, not on a calendar schedule.
• A mandatory second factor for email, finance and administrative panels.
• Revoking all access on the day of departure, from a single checklist.

In practice the whole transition takes 5–7 working days including training, and a corporate password manager costs around 300–600 roubles per employee per month. Compare that with the 3 million rouble minimum fine for a leak. If you need help with an access audit and rollout, write to us or see how we run client infrastructure under ongoing maintenance.