Why Is Reusing Passwords Dangerous? | How the Damage Spreads and What to Fix First

The scary part of reuse: one leak doesn't stay one leak

When people talk about password strength, attention tends to go to “how many characters” and “whether to include symbols”. But the most common way damage actually spreads isn't a password being cracked. It is a password that leaked from some other service and was being reused as is.

However long and complex your password is, if you use it on 10 services, its strength is the same as the weakest security among those 10. You only control your own password; you don't get to choose how each service stores it.

How credential stuffing works

Trying leaked ID and password pairs on one service after another is called credential stuffing (a list-based attack). Because it isn't brute force, the troublesome part is that defenders find it hard to tell apart from legitimate logins.

1. 1

   1. Data leaks from some service

   Even when users do nothing wrong, ID and password pairs can leak because of a flaw or a break-in on the service's side. Data from a service you left years ago can surface later, too.

2. 2

   2. It circulates as a list

   Leaked data is bundled, sold and shared. Because it includes email addresses, those can be used directly as IDs on other services.

3. 3

   3. It is tried automatically on other services

   Attackers feed the same pairs into large numbers of services by machine. Unlike guessing passwords one by one, they aim to get it right on the first try, so they don't trip limits on failed logins.

4. 4

   4. The accounts that let them in are taken over

   Only services where you reused the password are breached. If an email account is among them, the attacker can reset the passwords for your other services as well, and the damage spreads all at once.

Seen this way, the weak point to defend is clear. Individuals can't stop steps 2 or 3. All you can stop is step 4 — making sure the same pair doesn't work anywhere else.

Which accounts to fix first

Changing every account's password at once isn't realistic. If you start with the accounts where a takeover would hurt most, you can nip most of the risk in the bud with little effort.

The key to the order isn't the amount of money but “whether it spreads to other accounts”. Your email account is where password resets for almost every other service are sent, so regardless of money, give it its own unique password first.

Steps you can start today

1. 1

   1. Think of one password you are reusing right now

   Most people have one or two “usual” passwords. Write down the services where you use it, as far as you can remember. A perfect inventory isn't necessary.

2. 2

   2. Change just the two top-priority accounts first

   Give your email and mobile carrier accounts new passwords that aren't used anywhere else. That alone stops much of the chain reaction.

3. 3

   3. Generate new passwords instead of inventing them

   Passwords you make up yourself inevitably follow patterns. A generator creates a hard-to-guess string of around 16 characters in an instant. If a service doesn't accept symbols, switch to letters and numbers only.

4. 4

   4. Decide where to store them before changing anything

   You can't memorise random passwords. Even your browser's password saving is fine, but decide where they will be stored before you start changing them. If you skip this, you'll end up going back to easy-to-remember strings.

5. 5

   5. Turn on two-factor authentication

   Even if a password leaks, an extra check makes break-ins much harder. If an authenticator app or a passkey is available, set that up in preference to SMS.

6. 6

   6. Replace the rest as you use them

   For the remaining services, replace passwords one at a time the next time you log in. This reduces reuse more reliably than trying to do it all at once and giving up.

Tricks that seem to help but don't

What these have in common is that any trick that bends a password toward “something a human can remember” ends up with a pattern. Giving up on memorising and leaving it to storage produces stronger results in the end.

If you think a password may have leaked

1. 1

   1. Change your email password first

   Before anything else. Unless you secure this, the attacker can take back whatever you change through password resets.

2. 2

   2. Check login history and connected apps

   Major services have a screen showing recent login devices and locations. If you see a device you don't recognise, sign it out on the spot.

3. 3

   3. Change every account that used the same password

   Fixing only the one that leaked is pointless. Replace the password on every service that used the same pair.

4. 4

   4. Inspect forwarding rules and registered email addresses

   A standard takeover trick is to quietly set up automatic email forwarding or change the registered address. Always check these after changing your password.

5. 5

   5. If money is involved, contact each company

   The sooner you report fraudulent card use or transfers, the more likely they are to be covered. Keeping notes of what happened and when makes the process smoother.

FAQ

Isn't it impossible to have a different password for everything?

You don't need to remember them all. The realistic approach is to leave them to a password manager or your browser's saving feature and remember only one master password to open it. Start by making at least your email and payment accounts unique.

Is it safe to save passwords in my browser?

It is definitely safer than continuing to reuse passwords. If you lock your device and turn on two-factor authentication for the browser's sync account itself, that is enough protection for practical purposes.

If I have two-factor authentication, can I reuse passwords?

We don't recommend it. Two-factor authentication is an extra wall that makes break-ins harder, but your password is still a valid key. Many services also don't support two-factor authentication, and those become your weak spots.

Does the tool keep the passwords it generates?

This site's Password Generator only creates the string inside your browser; it doesn't send or store the results. Once you close the page, nothing remains.