The domino problem
Using the same password on several sites is understandable. Remembering one is easy, and remembering fifty is not. But it ties the security of every account to the weakest site that holds that password.
Imagine you use the same password for a small hobby forum, an online shop and your email. The forum may have modest security and might be breached. Once its stored logins are exposed, the password you use for your email is exposed too, even though your email provider did nothing wrong. Your protection is only as good as the least careful site that knows your password.
How one leak becomes many
The process is routine and largely automated, which is why it is so common.
- A site is breached. Email addresses and passwords, sometimes in a protected form and sometimes not, end up in the hands of criminals or in public lists. See breach exposure checks for how to learn if your details are among them.
- Stolen logins are tested elsewhere. Criminals use software to try the same email and password combinations on many other services, such as email providers, banks, shops and social networks. This is often called credential stuffing.
- Matches are kept and used. Where a login works, the attacker may read messages, reset other accounts, make purchases, steal stored details or sell access.
This happens at scale. The software does not care who you are. It simply tries enormous numbers of combinations, and even a small success rate is worthwhile for the people running it. You do not have to be a person of interest.
Why your email is the key
Email is often the most dangerous account to have in a reused-password pattern. Most services send password reset links to your email address. An attacker who gets into it can request resets for your other accounts and approve them. That is how a single reused password can cascade into a full account takeover, and why the clean-up described in post-breach cleanup is so time-consuming.
“But my password is strong”
A strong password does not fix reuse. If the same strong password is leaked by one site, it is just as usable for the attacker on all the others. Strength protects against guessing. Uniqueness protects against leaks. You need both.
Small variations do not help much either. Changing Maple2024! to Maple2025! or to Maple2024!shop is a pattern attackers expect and try automatically.
Signs it may have already affected you
- Sign-in alerts from places you have never been.
- Password reset emails you did not request.
- Friends receiving odd messages from your account.
- Purchases or changes you do not recognize.
- A breach notice that mentions a site where you used a shared password.
These are described in more detail under account takeover signs. If any applies, follow the steps for hacked account response promptly.
Breaking the habit gradually
Fixing every account at once is unrealistic. A staged approach works better.
Step 1: Secure your email. Give it a new, unique password or passphrase that you have never used anywhere else, and turn on a second step. The advice in two-step sign-in covers the basics.
Step 2: Choose a tool. Password managers make unique passwords practical, because they create and remember them. If you do not want one yet, a paper notebook kept in a safe place at home is far better than reuse, though it is less convenient and does not travel well.
Step 3: Fix the high-value accounts. Banking, payment services, shopping accounts with stored cards, cloud storage and anything holding identity documents.
Step 4: Fix accounts as you use them. The next time you sign in to a reused-password site, change the password then. Over a few weeks, most of your active accounts will be done without a big project.
Step 5: Use the manager’s report. Many managers show which of your passwords are reused or weak, giving you a to-do list.
Step 6: Close what you no longer use. Old accounts hold old data and old passwords. Deleting them reduces what can leak. The guide to downloading your data and closing old accounts covers the process.
Making new passwords
For accounts you open from now on, let a manager generate a long random password. For the very few you need to remember, such as the manager itself or your device, use a long passphrase built from random words, as described in memorable passphrases. Avoid personal details and famous phrases.
What if I cannot move away from reuse completely?
Progress counts. If you cannot manage everything, protect the accounts that matter most with unique passwords and a second step, and accept that less important ones may take longer. A throwaway shopping site that stores nothing sensitive carries less risk than your email or bank. But be honest about which accounts could reset others, because the importance of an account is not always obvious.
Where available, passkeys remove the issue entirely, since there is no password to reuse. The basics are explained in passkey basics.
Keep the bigger picture
Reuse is a habit, not a character flaw. It happens because the system asks people to remember more than humans can. Once each account has its own login and your email is well protected, a breach at any one site becomes a minor inconvenience, a password change on one account, rather than a chain reaction across your whole online life.