Strong, unique passwords and password managers

When you work remotely, your accounts are the front door to everything. There is no office badge or reception desk; whoever has your password is, as far as most systems can tell, you.

Unique matters more than clever

The single most damaging password habit is reuse. When a website you once signed up to gets breached, attackers take the leaked email and password combinations and try them against work email, VPNs, and cloud services. This is called credential stuffing, and it only works because people reuse passwords. A password that is unique to one account limits any breach to that account. So the rule is: every account gets its own password, and your work password is never used anywhere else.

Make them strong the easy way

Long beats complicated. NCSC guidance suggests building a strong, memorable password from three random words, something like "marble tractor sunset", which is far stronger than a short password with predictable substitutions like an exclamation mark on the end or a 3 in place of an e. Avoid anything guessable from your public life: pet names, football teams, children's birthdays, or the company name with a year after it.

Let a password manager do the work

Nobody can memorise dozens of strong unique passwords, and you shouldn't try. A password manager generates and stores them for you, so you only need to remember one strong master password. Use the password manager your organisation approves or provides. As a bonus, password managers help against phishing: they offer to fill your password only on the genuine site, so if your manager stays silent on a login page, treat that as a warning.

What not to do

Don't keep passwords in a notebook by the laptop, a text file on the desktop, or a spreadsheet named passwords. Don't share your password with anyone, including IT; a genuine IT team will never ask for it. And if you suspect a password has been exposed, change it and tell IT straight away.