Ask a school office what the software password is and you will often get an answer in one second: "school123", or the school's name with the year, or a sticky note on the monitor. That password guards children's records, fee ledgers, and exam results — and everyone in the building knows it. A school staff password policy does not need to be technical or complicated. It needs five simple rules that non-technical staff will actually follow.
This guide gives you those rules, explains how to introduce them without resistance, and covers the leaver procedures and two-factor steps that turn a policy on paper into protection in practice.
Why Passwords Are a School Problem
Schools have a specific password problem. Staff turnover is high — teachers and office staff join and leave every session. Technical confidence varies enormously — the principal may be comfortable with technology while the senior clerk has never used a password manager. Devices are shared — one office computer may serve three people in a day. And the data is sensitive — children's records deserve the same protection a bank gives money, but schools rarely have an IT person enforcing it.
The result is predictable: shared passwords, weak passwords, passwords written on paper in plain sight, and departed staff whose access never ends. Attackers know this. The most common way school accounts are compromised is not sophisticated hacking — it is guessing a weak password, reusing a password leaked from another site, or simply using a shared password that a former employee still knows. Every rule in this policy is aimed at one of those three paths.
The Five Rules Every Staff Member Follows
Keep the policy to five rules and print them where staff can see them. Rule 1: Everyone has their own account and password — never share, never borrow. Rule 2: Passwords are passphrases of at least four words (see below) — never a name, date, or "123". Rule 3: Never write a password on paper at the desk or share it by WhatsApp or SMS. Rule 4: Lock the screen every time you leave the desk, even for a minute. Rule 5: Report a suspected compromise immediately — no blame, no delay.
Five rules are the whole policy. Anything longer will not be read by the staff who need it most. The principal's job is to model them: if the principal shares their password "just this once", the policy is dead. Consistency from the top is the policy's real enforcement mechanism — see our staff training guide for how to introduce new rules without losing teaching days.
Passphrases: Strong and Memorable
The old advice — a complex jumble of letters, numbers, and symbols — produced passwords nobody could remember, so staff wrote them down. The modern advice is better: use a passphrase of four or more ordinary words that mean something to the user but nothing to anyone else. A phrase drawn from a personal memory — four words about a childhood street, a favourite meal, a family joke — is both far harder to guess than "School@2026" and far easier to remember.
Teach staff three passphrase habits: make it long (four words minimum), make it personal (not a famous quote or the school's motto, which others can guess), and make it unique (the school software password must not be the same as the staff member's Gmail or Facebook password — if one leaks, the other falls). For staff who struggle to remember, a small personal notebook kept in a pocket or bag is acceptable; a sticky note on the monitor is not. Forcing password changes every 30 days is outdated advice — it produces weaker passwords as staff cycle through predictable variations. Change passwords when there is a reason: a staff departure, a suspected compromise, or a known breach.
Policy in One Line
Sharing Bans and Leaver Procedures
Password sharing usually starts innocently: "I am on leave, use my login to issue receipts." The problem is that shared access cannot be revoked without changing the password, cannot be audited (whose actions were they?), and cannot be trusted once the password has spread. The policy must be absolute: no sharing, for any reason, for any duration. When someone is on leave, their tasks are reassigned to another staff member's account — never covered by lending a login.
Leaver procedures are equally important. When a staff member resigns or is dismissed, their account is deactivated on the last working day — not "next week" — and any shared passwords they may have known are changed the same day. Make account deactivation a line on the exit checklist, alongside returning keys and settling dues, so it never depends on someone remembering. The same applies to role changes: a teacher who moves to the office keeps their own account but gets the new role's permissions, and loses the old ones, on the day the move takes effect. These lifecycle habits are part of the school's wider data protection duties — see our student data privacy guide.
Two-Factor Authentication and Recovery
Two-factor authentication (2FA) — a code from the staff member's phone in addition to the password — is the single biggest upgrade a school can make after individual accounts. Even if a password is guessed or leaked, the account stays protected. Enable 2FA first on the accounts that matter most: principal, accountant, and office in-charge. Then roll it out to all staff, with a patient demonstration — the first setup takes five minutes, and staff who see it done once adopt it without fuss.
Plan for the human moments: a staff member who loses their phone needs a recovery path that does not involve waiting a week — the principal or admin should be able to reset 2FA after verifying identity in person. A staff member who forgets a password needs a reset process that goes through the admin, not through a colleague's account. And the school should keep a sealed, offline record of admin recovery details (in the principal's locked drawer, not on a shared drive) for genuine emergencies. A password policy that staff follow beats a perfect policy that nobody reads — five rules, modelled from the top, enforced at the transitions.
AI Help: Muse AI
Muse AI is Meta's personal AI assistant, available in the Muse app. It can help you write a one-page password policy poster for your staff room — five rules in plain Urdu and English — and a short training talk explaining passphrases with examples staff will remember.
Join Muse with invite code LTGSWD — in the Muse app, go to Settings > Redeem token and enter the code.
Disclosure: LTGSWD is the author's Muse invite code.