Reusing a password is the most common password mistake, and the most dangerous. No matter how strong it is, one leak can undo everything. This guide is part of our password basics series.

A short story

Imagine that you used one password on a small pizza delivery site, your email and your bank.

  1. The pizza site is hacked, and customer logins are stolen.
  2. Criminals sell the list.
  3. A bot tries your email and password on thousands of sites.
  4. It works on your email account.
  5. From your inbox, attackers reset other accounts and read your bank emails.
  6. Your money is gone, because of a pizza site.

This is called credential stuffing, and it happens every day, at a huge scale.

Why strength does not help

A long password protects you from guessing. It does nothing if the attacker already has it. If a site stores your password badly, or the password is captured by phishing, strength no longer matters. Only uniqueness contains the damage.

You do not control how sites store your password

You have no way of knowing how a small shop or forum protects your data. Assume that some sites you use will leak, and make sure that a leak cannot spread.

Small changes do not count

These are all the same password, as far as an attacker is concerned:

  • Rover2023
  • Rover2024
  • Rover2024!
  • RoverAmazon

Attackers apply these changes automatically. Our guide on what makes a password weak covers this.

How to stop reusing passwords

Nobody can memorize a unique password for every account, and you do not have to:

  1. Use a password manager, which creates and remembers them.
  2. Check for leaked passwords, to see which ones to replace first.
  3. Change your email and bank passwords first.
  4. Replace the rest as you log in to each site.
  5. Turn on two-factor login, so a leaked password is not enough.