Unique Passwords at Work: Stop Employees Reusing Them

Why are unique passwords the first thing to fix?

When a website is breached, attackers often get lists of email addresses and passwords. They then try those same pairs on other sites: email, cloud storage, banking, company tools. This is called credential stuffing, and it is automated, cheap and fast.

If an employee used the same password for a hobby forum and the company email, a breach at the forum becomes a breach at your company. Nobody had to guess anything, and no clever hacking was required.

That is why reuse is worth fixing before more exotic threats. It turns someone else's security failure into yours, and you cannot control how other websites store passwords.

Why do people reuse passwords in the first place?

Reuse is rarely laziness. It is a rational response to a memory problem: people have dozens of accounts and can remember a handful of passwords.

Common reasons in teams:

Shared accounts get a password that is easy to type and easy to tell a colleague.
Old rules forced frequent changes, so people made small variations of one base password.
There is no approved place to store passwords, so memory is the only option.

Your program should remove the memory problem, not lecture people about it. Current guidance such as NIST SP 800-63B also moved away from forced periodic changes and complex composition rules, towards length, screening against breached passwords and changing passwords when there is evidence of compromise.

It is also worth remembering that reuse is invisible. Nobody can tell from the outside which accounts share a password, which is why a tool that checks the whole vault is more reliable than asking people to self-report.

Step 1: Make a generator the default at every sign-up

The single most effective change is to make the strong, unique password the path of least resistance. A password manager that offers a generated password the moment someone fills in a sign-up form does exactly that.

Choose a manager with a browser extension that detects sign-up forms.
Ask people to accept the suggested password rather than typing their own.
Make sure the manager saves the new login automatically after sign-in, so nothing is lost.

Once people trust that the manager remembers everything, they stop needing a memorable password for anything except the manager itself.

Step 2: Screen passwords against known breaches

Breach screening tells you when a password appears in public breach data, which means attackers likely have it in their lists. It is one of the screening practices recommended in NIST SP 800-63B.

A common concern is privacy: do you have to send your passwords to a third party to check them? With Have I Been Pwned's k-anonymity method, you do not.

Your device computes a SHA-1 hash of the password.
Only the first five characters of that hash are sent to the service.
The service returns every breached hash that starts with those five characters, often hundreds.
Your device checks locally whether the full hash is in that list.

The service never sees the password or even the full hash. Run a check across the whole vault once, then fix anything flagged as breached or reused, starting with email and admin accounts.

Step 3: Turn on two-factor authentication everywhere it matters

Two-factor authentication (2FA) means a stolen password alone is not enough. Even if reuse slips through, a second factor blocks most credential stuffing attempts.

Start with email, the domain registrar, cloud storage, finance and admin consoles.
Prefer an authenticator app (TOTP codes) over SMS where the site allows it.
For shared accounts, store the authenticator secret in the team password manager, so 2FA does not depend on one person's phone.

CISA's guidance for organisations consistently lists multi-factor authentication among the most valuable basic steps.

Step 4: Give every shared account a unique login

Shared accounts are where reuse hides. The office Wi-Fi, the social media login and the supplier portal often share one "team password" that has lived for years.

Give each shared account its own generated password.
Store it in a shared folder, not in chat, email or a document.
Where possible, give fill-only access so people can sign in without seeing the password.
When someone leaves, change the passwords they could see.

For the mechanics, see how to share passwords with your team.

How do you build a culture that sticks?

Tools do most of the work, but habits close the gap. Keep the tone practical and blame-free.

One sentence policy: "Every work account gets a unique password from the password manager."
Ten-minute onboarding: install the extension with each new hire and generate their first password together.
Monthly health check: review breached and reused items as a team and fix a few each time.
Celebrate fixes, not failures. If someone reports a reused password, thank them.
Lead from the top. Managers using the tool openly does more than any memo.

Avoid strict rules you cannot check, such as banning personal reuse. Focus on work accounts, which you can actually see and fix.

How do you roll this out in 30 days?

A short timeline keeps momentum without overwhelming anyone.

Week	Focus
Week 1	Choose a password manager, import existing logins, create shared folders
Week 2	Install the extension for everyone, run a breach check, fix email and admin accounts first
Week 3	Turn on 2FA for critical accounts and move shared authenticator secrets into the vault
Week 4	Give each shared account a unique password, remove passwords from chat and documents

After the first month, the monthly health check keeps things on track. Expect a long tail of old accounts; fixing a handful each month is fine.

Measure progress with simple, honest numbers from your own vault: how many items are flagged as reused or breached this month compared with last month. Share that trend with the team.

How does BobWork Vault support this program?

BobWork Vault is a free, zero-knowledge team password manager, and it covers each step above:

Its Chrome extension offers a 20-character generated password on sign-up forms and saves new logins after you sign in.
Password health and breach alerts use Have I Been Pwned's k-anonymity method, so only the first five characters of a SHA-1 hash leave the browser.
It stores authenticator (TOTP) secrets and fills the 6-digit code after the password.
Shared folders support a Login only level, where the extension fills the password but the teammate cannot see or copy it.

It does not enforce a password policy, so the culture steps still matter. If it fits, you can start a free team vault and run your first health check today.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers

Questions

What is credential stuffing?

Credential stuffing is when attackers take email and password pairs leaked from one website and automatically try them on many other websites. It only works when people reuse passwords.

Should we force employees to change passwords every 90 days?

Current guidance such as NIST SP 800-63B advises against routine forced changes. Change a password when there is evidence it was compromised, and focus on unique, long passwords and breach screening.

Is it safe to check passwords against Have I Been Pwned?

Yes, when using the k-anonymity method. Only the first five characters of the password's SHA-1 hash are sent, and the match is done on your device.

Does BobWork Vault enforce password rules?

No. BobWork Vault has no enforced password policy. It makes unique passwords easy with a generator and flags reused or breached ones in password health.

How do we handle 2FA on shared accounts?

Store the authenticator secret in a shared folder of your team password manager so the code is available to whoever needs it, instead of relying on one person's phone.