Honestly, get them to use the built in password manager in their browser. It’s a huge step up from reusing passwords which they’re almost certainly doing, so it’s a case of not letting perfect be the enemy of improvement