🔄 How to Change a Password Correctly: A Small Business Guide
On this page
When Should You Change a Business Password?
The old advice — change your password every 90 days — has been officially retired. NIST SP 800-63B now recommends changing passwords only when there is evidence of compromise. Forced rotation encourages users to create weaker, more predictable passwords and reuse them across accounts. Instead, change passwords in these specific scenarios:
- After a breach — if a service you use suffers a security incident
- When an employee leaves — revoke access and change any passwords they knew
- Credential sharing discovered — if a password was shared over an insecure channel
- Suspicious login alerts — if you receive unexpected MFA prompts or login notifications
- Malware or phishing incident — if a device or user account was compromised
Step-by-Step: How to Change a Password Correctly
Changing a password is not as simple as typing a new one. Follow these steps to ensure the change actually improves your security. First, log into the account and navigate to the security or password settings. Second, do not type a new password manually — use a password generator like StrongPassFactory to generate a new one. Third, ensure your password manager captures the new password — do not click 'save' on the browser prompt until you have verified the password was updated successfully. Fourth, log out and log back in with the new password to confirm it works. Fifth, update any systems or devices where the old password was saved (email clients, VPN apps, backup services). Finally, if the account uses MFA — and it should — verify that MFA is still active after the password change (some services reset MFA on password change as a security measure). PureVPN — Secure Your Connection
The Dangers of Changing Passwords Incorrectly
Improper password changes can actually reduce your security. The most common mistake is reusing a variation of the old password — changing 'BlueFrog42!' to 'RedFrog42!' adds virtually no security because cracking tools know these patterns. Another common error is changing the password but not revoking existing sessions, leaving old sessions active with the old credentials. A third pitfall is failing to update the password in your password manager, leaving you locked out of your own account.
For VPN and encrypted communications, always update your credentials in your VPN app after changing passwords. Turbo VPN supports seamless credential updates across devices, ensuring your business connections remain protected.
Password Change Policies for Teams
When an employee leaves your company, their password changes must be systematic, not ad-hoc. Create a departure checklist that includes: changing the departed employee's individual passwords, rotating any shared credentials they had access to, revoking their password manager access, removing their devices from MFA lists, checking for any services where they may have personal accounts linked to business email, and documenting the changes in a password change log.
For shared accounts — like social media, utilities, or vendor portals — change the password immediately when any team member with access leaves. Use a password manager's built-in sharing feature so you can revoke access without changing the password for everyone. For secure coordination of such changes across remote teams, Hide My Name VPN provides encrypted team communication channels.
How to Avoid Password Fatigue in Your Business
Password fatigue — the exhaustion of managing dozens of credentials — is a real threat to business security. When employees feel overwhelmed, they revert to bad habits: reusing passwords, choosing simpler ones, or storing them insecurely. Combat password fatigue with these strategies.
First, invest in a quality password manager with team features. Second, set reasonable minimum password lengths — 16 characters for standard accounts, not 30. Third, enable SSO wherever possible so employees manage fewer passwords. Fourth, use passkeys where supported — they eliminate the need for passwords entirely on compatible services. Fifth, train your team on why password security matters, not just how to do it. Understanding the 'why' reduces resistance.
FAQs
How often should I change my business passwords?
Only when there is evidence of compromise, not on a fixed schedule. NIST officially retired the 90-day rotation rule in SP 800-63B. Change passwords after a breach, when an employee leaves, or if you suspect credential theft.
What is the safest way to change a password?
Generate the new password using a cryptographically secure password generator (like StrongPassFactory). Save it immediately to your password manager. Log out and verify the new password works. Revoke all existing sessions if the service offers that option. Update any devices or apps that had the old password saved.
Should I change all my passwords after a data breach?
Only for the specific service that was breached, and any other service where you reused that password. If you use unique passwords per account (which you should), only the breached service needs a password change. This is why unique passwords per account are so important — they contain breach blast radius to a single service.
Is it safe to change passwords on public Wi-Fi?
No. Public Wi-Fi is vulnerable to packet sniffing, man-in-the-middle attacks, and SSL stripping. If you must change a password on a public network, use a VPN to encrypt the connection. Turbo VPN provides encrypted tunnelling that protects your password change traffic from interception.
Sources
- NIST SP 800-63B Digital Identity Guidelines
- NCSC Password Guidance 2024
- Verizon 2025 Data Breach Investigations Report
- IBM Cost of a Data Breach 2026
- CISA Password Security Guidance
Affiliate Disclosure: This post may contain affiliate links. If you purchase through these links, we may earn a small commission at no extra cost to you. Our password generator is free to use. Full disclosure.
⚡ Try NordPass — NordPass Business - Free trial and experience enterprise-grade password security at an affordable price. Features include zero-knowledge encryption, cross-platform sync, and breach monitoring.