One Password, Every Door
The most damaging habit in personal security is also the most common: the same password twice. Here is exactly how one old breach becomes a key to your whole life — and the one change that ends it.
I have a really strong password. Long, symbols, the works. I just use it on most things so I can remember it.
Then its strength barely matters. The problem was never how hard it is to guess. It is how many doors it opens once someone has it once.
How the attack actually works
A site you used years ago gets breached, and your email and password leak. Attackers do not sit and target you — they run credential stuffingCredential stuffingTaking username-and-password pairs leaked from one site and trying them automatically on hundreds of others, betting that people reuse them.: replaying that email-and-password pair automatically against hundreds of other sites, betting you reused it. Often, you did.
2021: hobby-forum.example is breached
-> [email protected] : SuperStrongPass!99 leaks into a list
later: that pair is tried automatically against
-> your email provider (works? now they own everything)
-> your bank (works? direct loss)
-> your shopping accounts (works? saved cards)
- Line 2The password's strength did not save you. It was handed over in full by the weakest site you ever signed up to.
- Line 5Your email is the master key: password resets for everything else arrive there. Reusing your password on email is the worst single case.
Your password is 20 characters of random symbols — genuinely uncrackable by guessing. You use it on ten sites. How safe is it?
Which change reduces your risk the most?
The one change that ends it
Remembering passwords
- One strong password, reused so you can recall it
- Small variations (Pass1, Pass2) — a pattern, trivially guessed from one
- Storing them in a notes file or the browser with no master passwordLetting a vault remember
- A different random password per site, from a password manager
- One strong passphrase protecting the vault, and nothing else to remember
- Two-factor authentication on the accounts that matter most, especially emailA password manager turns "remember a hundred passwords" into "remember one". It is the highest-impact hour most people can spend on their security.
# you never see or type these; the manager fills them
bank.example : 7Fq!2vLm@9RtZx4wKp#
shop.example : Bd3^nQ8sJ!0uWc6yEh
email.example : Xa9$mR2!kLp7vNz#qT (plus a second factor)
# a breach of shop.example now tells an attacker nothing about the others
So my "strong password everywhere" was the weak part all along.
It is my favourite habit in other people. One old breach and I have a key I can try in a hundred locks. Take that away — a unique password each time — and I am back to attacking each door alone.
Which is the whole win. You cannot stop sites being breached. You can stop one breach from becoming all of them.
Legal
This is about protecting your own accounts. Using leaked credentials against accounts that are not yours — including "just testing" a reused password — is unauthorised access and a crime, full stop.
So a password's job is two jobs: hard to guess, and used exactly once. Miss the second and a single forgotten site can open your bank. Match it to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to. — everyone, at every tier, benefits from a password managerPassword managerAn encrypted vault that generates and remembers a different strong password for every account, so you only have to remember one. and two-factor on email. Next: two-factor itself — the second lock that makes one leaked passphrase no longer enough.