Two-Factor Authentication and Password Managers for the Accounts a Small Business Runs On

Most small businesses don't run on one system. They run on a handful of logins: the email account, the Google account behind the Business Profile, the social pages, the website and its domain, and the bookkeeping or payroll provider. Lose one and work stops. Lose the email and you can lose the rest, because email is where every other password reset lands.

The takeaway up front: two-factor authentication for small business accounts starts with the business email, then covers every account that can reset another one, with the backup codes saved before you need them. Keep every password in a password manager, and share access through it, never by sending a password or a code. Done in that order, a stolen password stops being enough to get in, and a lost phone stops being a lockout.

This plan builds on the two-factor setup guide published by Dhanutech, a tech blog that publishes practical, plain-English guides. Its method table and backup-code rules shape what follows; the small-business order and hand-off advice are ours.

Disclosure: this two-factor plan was produced in collaboration with Dhanutech.

Why a second step matters more than a stronger password

A password on its own fails in one move: someone gets it from a breach or a fake login page, and they're in. Two-factor authentication (also called two-step verification, 2SV or MFA) adds a check that a stolen password can't pass. As the US Cybersecurity and Infrastructure Security Agency puts it in its Turn On MFA advice: "Even if an unauthorized user steals your password, they won't be able to meet the second step requirement to access your accounts."

The UK's National Cyber Security Centre calls turning it on "one of the most effective ways to protect your online accounts from cyber criminals" and names email, banking, social media and online shopping as the accounts to cover. A business adds the accounts that hold its customers, its money and its domain.

Then there are the passwords themselves. In a 2023 Pew Research Center survey, 69% of Americans said they were overwhelmed by the number of passwords they have to keep track of, and 45% said they felt anxious about whether their passwords are strong and secure. An owner who also holds the business logins has more than most, and keeping track of them is the job a password manager does.

Two-factor authentication for small business accounts: the order that matters

Order matters because accounts reset each other. Whoever controls your email can reset almost everything else, and whoever controls your domain also controls your email if it runs on that domain. Work down this list.

One account comes before all of these: the password manager itself. Set it up first, with a long master password, its own two-factor authentication and printed recovery codes, because it is about to hold the backup codes for everything on the list.

The website and listings in rows 2 and 3 are the pieces our small business web presence guide walks you through setting up; this is how you keep them yours.

Which second step to pick: authenticator app, passkey or hardware security key

Not every second step is equally strong. Dhanutech's step-by-step 2FA setup guide for Google, Microsoft and Apple accounts ranks the options in a short method table:

• Hardware security key: a physical USB or NFC key that proves you hold it, rated "Strongest (phishing-resistant)".
• Passkey: a device-bound sign-in tied to your fingerprint or face, rated strong and phishing-resistant.
• Authenticator app: an app on your phone that generates rotating codes, rated strong.
• SMS text code: rated "Weakest" and kept as "a fallback".

Its rule: "use a hardware key or passkey where offered, an authenticator app everywhere else, and treat SMS as a last resort." The guide also shows where each provider puts the setting, because the names differ: 2-Step Verification at Google, two-step verification at Microsoft, Two-Factor Authentication at Apple.

CISA's fact sheet on implementing phishing-resistant MFA says the same from the other side: "While any form of MFA is better than no MFA and will reduce an organization's attack surface, phishing-resistant MFA is the gold standard."

For a small business, that becomes a simple split. Register two hardware security keys, one for daily use and one spare, on the email admin account and the domain registrar, the two accounts that can take everything else with them. Use passkeys where offered and an authenticator app everywhere else. Keep SMS only where it's the sole option, and still turn it on there: a weak second step beats none.

Backup codes: the step that prevents a lockout

Dhanutech's guide calls saving backup codes "the step almost everyone skips". For a business, it's the step that decides whether a lost phone is an annoying morning or a lost week. Backup codes are single-use codes that get you in when your phone is lost, broken or wiped. The guide's rules are:

1. Generate them right after you turn on two-factor authentication, not later.
2. Store them offline, as a printed copy in a safe place, or in a password manager's secure notes.
3. Never keep them in the same app or note as the password they protect.
4. Replace them after you use one, or once a year.

Two additions for a business. First, the password manager's own recovery codes can't live inside the password manager, so print those and keep them with the company's important papers. Second, tell one other trusted person where the printed codes are kept. If you're the only person who knows, a bad week for you becomes a bad week for the business.

Password managers: how to share access without sending a password

Sooner or later most owners hand work to someone else: a freelancer on the website, a bookkeeper, a helper on the social pages. Our guide on what to outsource first covers what to hand over.

CISA's advice on strong passwords is to "Create long, random, unique passwords with a password manager", and it sets the length at "At least 16 characters—longer is stronger!" A manager remembers them and changes how you share access:

• Give people their own login where the platform allows it. Website admin panels, business listings and social pages often let you add someone with their own role. Their two-factor authentication protects their access, and you remove the role when the work ends.
• Where a shared login can't be avoided, share it from the password manager, not by text message or in an email with the password typed out.
• Never pass on a one-time code. Dhanutech's guide is blunt: "Legitimate support staff will never ask you for a one-time code." Nor will your web host, your bank or a real colleague.
• Close the door when the job ends. Remove the user or the shared item, then change any password the person could see.

Choosing a manager comes down to fit: sharing for the people you work with, its own two-factor authentication, and apps for your devices. Dhanutech's free-vs-paid password manager comparison is a reasonable place to start. It separates a free pick from a paid upgrade and tells readers to confirm prices on the vendor's page on the day.

Mistakes that undo the setup

Dhanutech's guide lists common mistakes, and each has a business version:

• Two-factor authentication on only one device. If the owner's phone is the only second step for every account, one dropped phone stops the business. Add a second trusted device, a second admin or a spare key.
• Ignoring the recovery email. Check each account's recovery address and phone. In a small business it can be a personal inbox nobody opens, or the address of someone who has left.
• Sharing codes. No legitimate provider needs your one-time code.
• Stopping at email. Email comes first, not last. Work down the whole list.

How to use Dhanutech's guides, and how to judge any how-to guide

Dhanutech is a tech blog that publishes practical, plain-English guides, free to read with no sign-up. Its About page says its goal is "to make technology easier to understand through practical guides, helpful tutorials, and clear explanations", and names its audience as "beginners and technology enthusiasts". Its guides sit in sections such as Cybersecurity & Online Privacy, How-To Guides & Tutorials, Software & App Reviews, and AI Tools & Productivity.

Who needs that kind of guide? An owner or a small team that manages its own accounts and devices without an IT department, and needs the exact settings for one platform today.

How to pick the right guide, there or anywhere else:

• Match the guide to the job. For this plan, the 2FA setup guide; for choosing a manager, the password manager comparison.
• Check the date. Each guide shows its publication date, and settings menus move.
• Look for named sources. The 2FA guide points readers to CISA's guidance on phishing-resistant MFA, so you can read the agency's own wording.
• Look for what it says it didn't do. Its password manager comparison says it read the vendors' own pricing and feature pages and ran no lab tests, so confirm details on the vendor's page before you pay.
• Use the format. Each guide opens with a "Key Takeaways" summary and gives numbered steps, and most end with a FAQ.

A setup plan you can finish this week

Dhanutech's 2FA guide puts the job at about ten minutes per account, so do the email today and one or two accounts a day after that:

• [ ] Password manager set up, with its recovery codes printed and stored away from it.
• [ ] Business email, then rows 2 to 5 of the table: strongest second step, backup codes saved, recovery email and phone checked.
• [ ] Shared logins moved into the password manager, and anyone who has left removed.
• [ ] A second trusted person told where the printed codes are kept.

FAQ

What if I lose my phone?

Sign in with a saved backup code, a second trusted device or the account's recovery process. That's the reason to generate backup codes before you need them. Once you're back in, remove the lost phone from each account and set up the second step on the new one.

Is it risky to keep every password in one password manager?

It puts a lot in one place, so treat the manager as the most important account you have: a long, unique master password, its own two-factor authentication, and recovery codes kept outside it. The realistic alternative for most owners is reusing a few memorable passwords, and reuse is how one breach turns into many. No tool makes an account impossible to break into, but this setup makes the common attacks much harder.

Should we change all our passwords every few months?

Not on a schedule. NIST's digital identity guidelines advise against requiring changes "arbitrarily (e.g., periodically)" without a request or evidence of compromise. Change a password when someone with access leaves, when a provider reports a breach, or when you suspect a leak.

Lock the business email today, save its backup codes, and work down the list one account at a time. For the exact settings on Google, Microsoft and Apple accounts, Dhanutech's plain-English guides are a sensible place to start; check each guide's date against the provider's own help page.