If you came to the Summit, the password-cracking demo is probably the bit that stuck. A short, complex-looking password cracked in seconds. A long, simple one safe for longer than you will be alive. That demo overturns almost everything people were taught about passwords, and this guide is the written version you can act on.
Passkeys are where everything is heading, and we have a separate guide on those, but passwords are not gone yet. The login to your Windows computers, plenty of older systems, and the fallback for nearly everything still rely on them. So it is worth getting them right, and “right” is not what most people think.
For years the advice was to make passwords complicated. A capital letter, a number, a symbol, the lot. So everyone landed on something like Nursery1! and felt secure.
Here is the uncomfortable truth the demo showed. Attackers do not sit there guessing your password by hand. They use software that tries billions of combinations a second, and the thing that defeats that software is not complexity, it is length. Every extra character multiplies the time needed to crack it, far more than swapping an “a” for an “@” ever does. Nursery1! is short and follows a predictable pattern the software expects, so it falls fast. A longer phrase, even an obvious one, takes vastly longer.
The modern advice, and the demo proves it, is to use a passphrase. Three or four random words strung together, like coffee-window-tractor-lamp, is both far stronger than Nursery1! and far easier to remember and type. Longer and simpler beats shorter and fiddly, every time.
Even a strong password has a fatal weakness if you use it in more than one place.
Picture it. You use the same good password for your Windows login, your email and a shopping site. The shopping site gets breached, which happens constantly and is entirely out of your control. The attackers now have your email and that password. The first thing they do is try that same combination everywhere else, automatically, across thousands of services. One breach you had nothing to do with has just handed them your email and your computer.
This is why every account needs its own unique password. Not a variation, not the same word with a different number on the end, genuinely different. The maths is simple: if every password is unique, a breach of one is a breach of one. If they are all the same, a breach of one is a breach of everything.
Nobody can remember dozens of unique passphrases, which is exactly why the next section exists.
The only realistic way to have a unique, strong password for every account is to stop trying to remember them. A password manager does the remembering for you. You memorise one strong master passphrase, and the manager generates, stores and fills in a long unique password for every account you have.
We recommend Keeper. You log into Keeper, and it logs you into everything else. It works across your computer and your phone, it warns you when a password is weak or has turned up in a known breach, and, usefully, it can store passkeys too, so it carries you forward as you move beyond passwords rather than locking you into the old way.
For a nursery there is a second big win. Keeper lets you share credentials through vaults rather than by telling people the password, which solves the shared-password and leaver problems we cover in the Leavers guide. And because Microsoft 365 can sign your staff straight into Keeper, it is one login that unlocks everything, less to remember, not more.
Even with a long, unique password, you want a backup for the day it somehow leaks. That backup is two-factor authentication, 2FA.
2FA means that after the password, the system asks for a second proof, usually a tap or a code on your phone. So even if an attacker has your password, they cannot get in without your phone in their hand. It is the difference between a stolen password being a catastrophe and being a non-event. Turn it on everywhere it is offered, starting with email and Microsoft 365, which our 2FA guide walks through step by step.
A few specifics for the computers themselves. Make sure every member of staff signs in with their own account, not a shared “nursery” login, because a shared login is impossible to hold anyone accountable for and impossible to cleanly remove when someone leaves. Set Windows to lock the screen automatically after a few idle minutes, so an unattended machine in a busy room is not an open door. And make sure day-to-day accounts are not administrator accounts, which limits the damage if one is ever compromised, a point we cover in the broader permissions thinking.
Forget complicated. Think long and unique. A memorable four-word passphrase beats Nursery1! comfortably, a different one for every account means a single breach stays a single breach, and a password manager like Keeper makes that actually doable instead of a fantasy. Add 2FA as the safety net, and you have closed the gap that lets most attackers in, while you move towards passkeys at your own pace.
Octopus 365 has supported nurseries since 2011, and James has worked with early years settings since 2009. If you’d like a hand setting up a password manager for your team, or tidying up how your staff log in to their computers, get in touch any time. No hard sell, just a conversation.