The One Password Mistake That Breaks Everything: Reuse
You can have a strong password and still get owned. All it takes is using the same password in two places. One site gets breached, attackers get your credentials, and then they try them on every other site tied to your email address. This is called credential stuffing, and it's the most common way accounts get taken over. Not phishing. Not brute force. Reuse.
How it works
Credential stuffing is simple and almost fully automated.
Scale: public breach databases contain billions of credential pairs. Services like Have I Been Pwned index hundreds of millions of accounts across thousands of known breaches. If you've been reusing a password for a few years, the odds that it appears in at least one breach are significant.
Why "unique" variations don't help
A common response to the reuse problem is variation: use one base password but change it slightly per site. Netflix gets Password1-netflix, Gmail gets Password1-gmail, and so on. This feels systematic. It isn't safe.
Attackers know this pattern. When one account is cracked and the pattern is visible, automated tools immediately try the base password combined with other site names against every other account tied to your email address. A site-suffix variation provides almost no additional protection once one account is compromised.
Variations like adding a !, capitalizing the first letter, or appending a number at the end are also well-known. They're in every cracking ruleset. A "unique" password that follows a predictable pattern isn't really unique.
The only real fix
The solution is genuinely unique, genuinely random passwords for every account. The only practical way to do that is a password manager.
- A password manager generates and stores a different random password for each site. You don't need to remember any of them. The manager fills them automatically.
- If one site gets breached, only that site is affected. The credential that leaks doesn't work anywhere else because it was never used anywhere else.
- The master password is the only one you need to memorize. Make it a strong passphrase and protect it with MFA.
Bitwarden is free and open source. 1Password and Dashlane are strong paid options. Any of them, consistently used, eliminates the reuse problem entirely.
What to do if you've been reusing
If you're currently reusing passwords, the fix is straightforward but takes a bit of time to do properly.
- Set up a password manager and create a strong master passphrase.
- Check your email against Have I Been Pwned (haveibeenpwned.com) to see which services have been breached.
- Start with your highest-risk accounts: email, banking, your password manager itself. Change those passwords to new, unique, randomly generated ones first.
- Enable multi-factor authentication on every account that offers it, especially email and financial accounts.
- Work through the rest of your accounts over time. Import existing accounts into the manager and replace each password the next time you log in.
You don't need to fix everything at once. Securing your email and banking first removes the biggest risk. Work through the rest at a pace you can sustain.
The bottom line
Password strength doesn't matter if the same password is used in multiple places. One breach anywhere becomes a breach everywhere the same credential works. The protection isn't a stronger password — it's a different password on every site.
A password manager is not optional if you want real security. It's the only tool that makes unique passwords practical at scale.