Passwords Like "Kenya2025!" and Why Hackers Love You
Confession time. Somewhere in this country, right now, an office computer is protected by the password "Password123". Another one uses the company name followed by the year. A third uses "Kenya2025!" because the IT policy said it needed a capital letter, a number and a symbol, and the person who set it was very pleased with themselves. Welcome to password security in Kenya's offices.
If one of those is yours, no shame. Most people choose passwords the same way: something easy to remember, adjusted just enough to satisfy the rules. Unfortunately, that is exactly what attackers expect.
How passwords actually get cracked
Many people imagine a hacker sitting in a dark room, guessing their password one try at a time. In reality, most attacks are automated and lazy. Attackers use lists of common passwords, words from the dictionary, names, places, football clubs and years, and computers try them very quickly.
So a password like "Kenya2025!" is not clever. It is a country, a year and the most popular symbol, in the most predictable order. Similar patterns include:
Your company name plus the year
Your child's name plus their birthday
Your favourite football club plus a number
Any keyboard pattern like qwerty or 123456
Your phone number, which is printed on your business card
The other big problem is reuse. Fatuma uses the same password for her work email, her personal email, an online shop she bought shoes from once and the office accounting system. When the shoe shop gets breached, attackers try that email and password everywhere else. This is called credential stuffing, and it is as unpleasant as it sounds.
What a good password looks like
Length beats complexity. A long passphrase made of several random words is much harder for a computer to guess than a short word with symbols sprinkled on top, and it is easier for a human to remember.
Something like four unrelated words strung together, say a vegetable, a vehicle, a weather word and a colour, gives you a password that is long, odd and memorable. The key word there is unrelated. "Nairobi Traffic Is Terrible" is long, but everyone in Kenya would guess it.
Nobody can remember 40 passwords
This is where people give up and go back to "Kenya2025!". The honest answer is that you should not try to remember them all. Use a password manager.
A password manager is an app that stores your passwords in an encrypted vault. You remember one strong master password, and it remembers everything else, generates new random passwords and fills them in for you. Many good ones exist, including free options and business versions where a manager can share specific logins with specific staff.
Sharing is important. Right now, many offices share the M-Pesa portal login, the KRA iTax login and the bank login by sending them on WhatsApp. That message then lives forever on several phones. A password manager lets you share access without the password floating around in chats.
Turn on two-factor authentication
Even a great password can leak. Two-factor authentication, often called 2FA, adds a second step when you log in, usually a code from an authenticator app or an SMS. Even if someone steals your password, they also need your phone.
Switch it on, at minimum, for:
Business email, because whoever controls your email can reset everything else
Banking and payment portals
Your website and domain accounts
Cloud storage and accounting software
Social media pages that customers see
Authenticator apps are generally safer than SMS codes, since SIM swap fraud is a real thing. But SMS is still far better than nothing.
A short password security policy your Kenyan team will follow
Long IT policies get signed and ignored. Try a short one instead:
Use a password manager for all work accounts
Never reuse a work password anywhere else
Turn on 2FA wherever it is offered
Never send passwords on WhatsApp, SMS or email
Change the shared passwords whenever someone leaves the company
That last one is often forgotten. Njoroge left the company in March. In August, someone noticed he could still log in to the supplier portal. He was not doing anything bad, just checking prices out of habit, but the next ex-employee might not be so innocent.
Go and change one weak password today. Start with your email. And if your new one contains the word "Kenya" and the current year, start again. Hackers love you, but you do not have to love them back.
Once email is sorted, do the bank and payment logins next, then the rest over a week. One chai break per password is a perfectly respectable pace. If you would like help putting proper access controls into your business systems, see what we offer.