DEV Community

Kokal Limited
Kokal Limited

Posted on • Originally published at strongpassfactory.com

How to Change a Password Correctly: A Developer's Guide for Small Teams

#passwordsecurity #onlinesafety #cybersecurity

Changing a password sounds trivial—click "forgot password," type a new one, done. But if you run infrastructure for a small business or team, doing it correctly matters more than doing it fast. A sloppy password rotation can lock out services, break automation, or leave old credentials floating around in logs and config files.

Here's how to do it right.

1. Don't Just Change It—Rotate It

A password change should assume the old one is already compromised. That means:

  • Invalidate active sessions after the change
  • Revoke API tokens or app passwords tied to the old credential
  • Check for the password hardcoded in scripts, .env files, or CI secrets 
# Quick sweep for a leaked password string in your repo
grep -rn "OldP@ssw0rd" . --include="*.env" --include="*.yml"
Enter fullscreen mode Exit fullscreen mode

If it shows up anywhere in version control, rotating the password isn't enough—you'll want to scrub the history too.

2. Generate, Don't Invent

Humans are bad at randomness. Let a tool do it:

# 20-char high-entropy password
openssl rand -base64 20

# Or with a password manager CLI
op item create --category=login --generate-password='letters,digits,symbols,32'
Enter fullscreen mode Exit fullscreen mode

Aim for length over complexity. A 20+ character random string beats P@ssw0rd! every time.

3. Update Everywhere It Lives

The most common failure isn't a weak password—it's a stale one. When you rotate a shared credential, update:

  • The password manager (single source of truth)
  • CI/CD secrets and environment variables
  • Any service accounts or cron jobs that authenticate with it

4. Enforce It as Policy

For a small team, tooling beats memory. Push everyone onto a shared password manager, require MFA, and stop forcing arbitrary 90-day resets—NIST guidance now recommends changing passwords only when there's evidence of compromise, not on a fixed timer.

Bottom Line

A correct password change is a small workflow: rotate the assumption of compromise, generate high entropy, propagate everywhere, and back it with MFA. Do that consistently and password hygiene stops being a fire drill.

Originally published on strongpassfactory.com

Top comments (0)