By PC Madness ·
The short answer
Saving passwords in your web browser is better than reusing the same weak password everywhere, and for a sole trader with multi-factor authentication switched on it can be a reasonable start. Once a business has staff, shared logins or anyone leaving, a business password manager does a job the browser was never designed for: it lets the business, not each person, control who has access to what.
This article explains what each option actually does, where browser-saved passwords fall short for a business, and how to tell which one suits yours.
What browser-saved passwords do well
Most modern browsers offer to save a password the first time you log in to a site, then fill it in for you next time. Many can suggest a strong random password when you create an account, and some warn you when a saved password has turned up in a known data breach.
That solves the two biggest everyday problems: people choosing weak passwords and people reusing the same one on every site. Browsers also only fill a saved password on the site it was saved for, which gives some protection against lookalike login pages.
It costs nothing, needs no setup and people already use it. For one person running a business from one or two devices, with multi-factor authentication on email and banking, that can be enough.
Where browser passwords fall short for a business
The problem isn't that browsers store passwords badly. It's that they store them for a person, not a business. That shows up in a few ways once you have a team.
- The business can't see or control them. Each staff member's passwords live in their own browser profile. There's no central view of which accounts exist, who has access to them, or whether the passwords are any good.
- Personal and work accounts get mixed. If a staff member signs in to their browser with a personal account, business passwords can sync to that personal account and to their home devices.
- Sharing is unsafe. Shared logins, such as a supplier portal or the company social media account, end up being passed around by email, text or a spreadsheet, because the browser has no safe way to share one password with three people.
- Offboarding is guesswork. When someone leaves, the business doesn't know which passwords they had saved, so it can't be sure which ones need changing.
- They're a target. Some malware is built specifically to steal passwords and login sessions stored in browsers. Anyone who gets into an unlocked computer may also be able to use the saved logins.
What a business password manager adds
A business password manager is a separate, encrypted vault for passwords, built for teams. Like a browser, it generates strong passwords and fills them in for you. The difference is the layer of control on top.
- Company-wide password policies. The business sets the rules, such as length and complexity, rather than relying on each person to follow them.
- Safe sharing. Shared logins can be given to the people who need them, without the password being sent around, and taken away again when they no longer need it.
- Clean offboarding. When someone leaves, their access to shared passwords is removed from one place, and you know which shared accounts they could reach.
- Visibility. Administrators can see weak, reused or old passwords across the business and get them fixed.
- Works across browsers and devices. The vault isn't tied to one browser, so it keeps working if staff use a different browser or a phone.
A fair comparison
Browser-saved passwords are free, built in and better than reusing passwords.
| Browser-saved passwords: a reasonable choice when | A business password manager: the better choice when |
|---|---|
|
|
Most businesses with staff fall into the second group. The browser option isn't wrong, it just doesn't give the business any control over its own logins.
A password manager isn't the whole answer
Even the best password can be stolen. A convincing phishing email can trick someone into typing it into a fake page, and a breach at a website your staff use can expose it without anyone doing anything wrong.
That's why passwords work best as one layer among several. Multi-factor authentication means a stolen password isn't enough on its own. Dark web monitoring watches for staff passwords turning up in breaches so they can be changed quickly. Security awareness training teaches staff to spot the fake login pages built to steal passwords in the first place.
Moving from the browser to a password manager
Switching doesn't have to be disruptive. A typical move looks like this:
- Set up the business vault and the company password policy first.
- Import each person's saved browser passwords into the vault, then remove them from the browser and turn off the browser's offer to save new ones.
- Move shared logins into shared folders, and change any password that has been sent by email or kept in a spreadsheet.
- Switch on multi-factor authentication for the vault itself and for key accounts.
- Fix the weak and reused passwords the vault reports, starting with email and anything financial.
For staff, filling in passwords works much the same way it did in the browser, so there's little to relearn.
How PC Madness can help
PC Madness includes business password management with company-wide password policies as part of our business VPN and password management service, backed by multi-factor authentication and dark web monitoring. It sits within our managed IT services for Perth businesses, run from our Midland HQ.
Not sure whether your team needs it yet? Send us a message to book a free, obligation-free IT security audit. We'll look at how passwords are handled today and tell you honestly whether the browser is fine for now or it's time to move.
