Most small businesses have one: a file called Logins.xlsx on the shared drive, with every account the business uses in one tidy list. It is the easiest security win going, and it takes an afternoon to fix.
In short
One file of passwords turns every account you have into a single prize.
Putting a password on the file does not fix it.
Move the logins into a password manager, share them per person, then delete the file properly.
Why the spreadsheet is the problem
Whoever opens that file holds everything: email, banking, the website, the accounts package. And these files are never protected as well as the things they unlock. They sit on shared drives and in inboxes, and they get forwarded "just this once".
There is never only one copy either. There is the original, the one attached to an email from last spring, and the one on somebody's desktop.
What to do this week
Stop adding to it today. New logins go straight into a password manager.
Move what is in it. Shared logins belong in a shared vault, where access is per person and can be removed when someone leaves.
Hunt down the copies. Email attachments, downloads folders, desktops.
Change the passwords that matter. Start with email and banking. Assume anything in the file has been seen.
Delete it properly. From the share, the bin and the backups you control.
While you are there: long beats clever
Winter2026! looks strong. It is a word, a year and a punctuation mark, which is exactly the pattern cracking tools try first. Three unrelated words, such as "paddle lantern biscuit", beat any short clever substitution.
You should only ever need to remember one or two passwords. The rest belong to the password manager. If you can remember all your passwords, you have too few passwords.
A bonus you get for free
A password manager fills in logins by exact web address. On a lookalike sign-in page it stays silent. That silence is a warning: stop, and check where you are.
Want a hand?
We move teams off the password spreadsheet all the time. No judgement. We set up the manager, move the logins with you, and make sure the old file is really gone. Talk to us, or see how we look after cyber security and audit readiness for creative businesses.