What makes a strong password for your store admin?

Why it matters more than you think

Your store admin holds your orders, your customers' addresses and phone numbers and your prices. Whoever gets in can read your customer details or change what you sell. So the password protecting it deserves real care, more than a throwaway account.

The three rules that matter

• Make it long. Length does more for strength than clever symbols.
• Make it unique. Never use it anywhere else.
• Keep it out of sight. Do not stick it on the laptop or send it over chat.

Everything else is detail.

Long beats complicated

A short password with an exclamation mark at the end is easy for software to guess. A long phrase of ordinary words is much harder. One practical way is to join several unrelated words into a sentence only you would think of.

An example style, not one to copy: three random words and a number you do not use elsewhere, like "teapot monsoon scooter 47 jasmine". It is easy to remember because you can picture it, and long enough to be hard to guess.

Do not use your shop name, your phone number, a birthday, your child's name or "password123". People who try to break in start with exactly those.

Never reuse one

When a small website is hacked, its leaked passwords get tried on email, social media and shopping sites. If your store admin shares a password with your Instagram, a breach at one place opens the other. Use a different phrase for every important account.

Use a password manager

You cannot remember twenty long, different passwords, and you should not try. A password manager is an app that stores them all behind one strong master phrase, fills them in for you and can generate new ones. Many phones and browsers have a basic one built in, and there are dedicated apps too. Check each option's reputation and read its help pages before choosing.

Protect the master phrase well, and write a copy on paper kept somewhere safe at home, in case you forget.

What Varchas checks

From the admin code, a password has to meet a minimum length, and there is also an upper limit of 72 bytes, so an extremely long passphrase may be rejected. If the form complains, shorten your phrase a little rather than adding odd symbols. Also, after you reset your password, the admin treats older logged-in sessions as expired, so a stolen session cannot keep working. I have not found any other password rules in the code, so do not assume extra checks exist.

Sharing with a helper

If someone helps you with orders, avoid sharing your own login. Ask whether they can have their own access, and if not, change the password when they stop helping. Do not send passwords through WhatsApp, which stays in chat history.

Pair it with a second step

A strong password is the first lock. A second step, such as a code, is the second, though I could not find it offered in the Varchas admin, so read what two-step verification is and enable it on your email, where it counts most.

Where to start

Change your store admin password to a new long phrase this week, store it in a password manager and use the same habit for your email. For a related guide on protecting what your customers trusted you with, see keeping your customer data yours.