Passkeys and password managers: the end of remembering passwords

Passwords fail small businesses in predictable ways. Here is what password managers and passkeys actually do, and a sensible order to roll them out.

October is Cyber Security Awareness Month, which makes it a good moment to talk about the thing that causes more grief in small businesses than almost anything else: passwords. Not exotic hacking. Passwords. Reused ones, guessed ones, written on sticky notes, shared across the whole team on a whiteboard, and reset so often that everyone keeps a secret list somewhere just to survive the week.

Why passwords fail

Passwords ask humans to do something humans are bad at: invent dozens of unique, unguessable strings and remember them forever. So people cope the only way they can. They reuse the same password everywhere, they make small predictable variations, they share logins between staff because it is easier, and they write them down. None of this is laziness. It is a system demanding the impossible and people improvising around it. The problem is that criminals know the improvisations, and a password reused on one breached website gets tried against your email and accounting software within hours.

The result is that one weak habit can undo every other protection you have. The Australian Cyber Security Centre has warned for years that stolen or guessed passwords sit behind a large share of reported incidents, and that matches what we see when we are called in to help after the fact. The fix is not asking people to try harder. It is taking the burden off people entirely.

What a password manager does for a team

A password manager is a secure vault that remembers every login for you. You remember one strong master password (or use your fingerprint), and the vault fills in the rest. For a business, the team version is where it gets genuinely useful. Shared vaults let the people who need the supplier portal login access it without anyone texting passwords around. When someone leaves, offboarding is one click instead of a nervous afternoon changing a dozen logins. And the daily question "what's the Xero login again?" simply stops being asked, because the answer is always the same: it is in the vault.

What a passkey is, in plain words

A passkey is the newer idea, and it is simpler than it sounds. Instead of typing a secret, your phone or laptop proves it is you, usually with your fingerprint, face or device PIN. There is nothing to type, nothing to remember, and nothing for a criminal to steal or trick you into handing over. That last part matters: passkeys are resistant to phishing, because there is no password to type into a fake website in the first place.

This is not future technology. Microsoft, Google and Apple all support passkeys now, and a growing number of banks and business apps do too. If you have signed into an account recently with your fingerprint instead of a password, you have probably already used one.

A sensible rollout order for a small business

You do not need to change everything at once. This is the order we walk our own clients through:

1. Start with the owner or manager. Set up the password manager and move your own logins in first, so you understand it before the team does.
2. Turn on multi-factor authentication everywhere it is offered, starting with email, banking and accounting. This is the extra approval step that stops a stolen password being enough on its own.
3. Add passkeys on the big accounts: your Microsoft or Google login first, then anywhere else that offers it.
4. Roll the password manager out to the team with shared vaults for shared logins, and retire the spreadsheet, notebook or whiteboard.
5. Clean up the leftovers: close old accounts, remove access for people who have left, and set a reminder to review access every quarter.

A word on shared logins

Most small businesses have at least one login everyone shares: the front-desk email, the supplier portal, the rostering app. Shared logins are where security quietly falls apart, because nobody knows who did what, and when someone leaves the password either stays the same forever or changes and locks everyone out. A team password manager handles this properly: one shared login, stored once in a shared vault, visible only to the people who need it, and changeable in one place. You keep the convenience and lose the chaos.

What about the old systems that still need a password?

Every business has one: the older program that only takes a password and will for years. That is fine. Those logins live in the password manager like everything else, with a long unique password you never have to remember. The goal is not perfection, it is making the important accounts strong and the rest manageable.

A quick glossary in plain English

Phishing is a fake email, text or website that tricks you into typing in your login. Multi-factor authentication (MFA) is the extra approval step after your password, usually a prompt on your phone. A vault is the encrypted store inside a password manager where your logins live. And a passkey is a login that lives on your device and is unlocked by your fingerprint, face or PIN. That is genuinely all the vocabulary you need for this conversation.

What this looks like day to day

Once it is set up, the daily experience is anticlimactic, which is the point. You open Xero and the vault fills in the login. You sign into your email with your fingerprint. A new starter gets access to the shared vaults they need on day one, and a leaver loses it all in one click. Nobody types a password often enough to remember one, and that is exactly how it should be.

The objections we hear

"What if I lose my phone?" Passkeys sync securely across your devices through your Microsoft, Google or Apple account, and there are recovery options. "Is it safe to keep everything in one vault?" Yes, because the vault is encrypted and protected by the strongest login you have, which is a far better bet than the same weak password in twenty places. Reputable managers are built so even the company behind them cannot read your vault, which is exactly what you want. "Will the team hate it?" In our experience the opposite: the day the password manager goes in is the day password resets stop being a weekly event, and new starters stop needing a handwritten list of logins on their first morning.

If you want a quick read on where your business stands, our free Cyber Security Scorecard takes about five minutes and gives you a plain-English report. It is a good first step before you change anything, and it gives us a shared starting point if you would like a hand with the rollout.

• passkeys
• password manager
• cyber security
• mfa
• small business