Security Passwords: how to make them strong and keep track of them
Why reusing one password is the most expensive habit online
Credential stuffing explained: how one leaked password becomes a dozen compromised accounts, why attackers do not need to crack anything, and how to unwind reuse in an evening.
The short answer
- Reuse is dangerous because attackers replay leaked email and password pairs across hundreds of sites automatically, so nothing has to be cracked and password strength makes no difference.
- The pairs come from breached sites that stored passwords badly, from phishing pages and from password stealing malware, and they stay useful for years.
- Your email account is the blast radius: whoever holds it can trigger password resets for everything else and hide the alerts with a forwarding rule.
- Adding a number or the site name to a base password does not count as a different password, because stuffing tools try those mutations by default.
- Fixing reuse works in priority order: email first, then anything with money, then anything with a saved card, then the rest as you sign in.
Reusing a password is expensive because the attack against it is cheap. Nobody has to crack anything. When a site you signed up to years ago leaks, your email address and that password become one line in a file, and software replays that exact pair against hundreds of other services at machine speed. The technique is called credential stuffing, and it is the reason a single forgotten forum account can end with someone inside your email, your cloud storage and the shop that has your card on file.
How credential stuffing actually works
Start with where the pairs come from. Three sources supply almost all of them. A site gets breached and stored passwords badly, either in plain text or with a hashing method old enough to reverse in bulk. A phishing page collects what you typed directly, which is why the fake login page still works on careful people. Or password stealing malware on somebody's computer scrapes every credential saved in the browser and uploads the lot.
Those results get merged into combination lists, often billions of lines long, sorted and deduplicated and passed around. From there the process is industrial:
- Load the list into a tool that knows the login sequence for hundreds of popular services.
- Route each attempt through a different residential internet address, so the traffic looks like ordinary customers rather than one machine hammering the door.
- Try each email and password pair, throttled enough to stay under the rate limits.
- Keep every combination that returns a successful login, and sell or work through the hits.
Success rates per attempt are tiny, usually well under one percent. That is not a comfort. When the list holds tens of millions of pairs, a fraction of one percent still means thousands of working accounts, and the attempts cost almost nothing. Rate limiting, bot detection and impossible travel checks push the number down but do not take it to zero.
The critical point is what defeats it. Password length does nothing here, because the password is not being guessed. Complexity does nothing. A 30 character random monster reused on two sites is exactly as exposed as hunter2 once the site holding it leaks. Only two things help: a different password everywhere, and a second factor on the accounts that matter.
The blast radius starts at your email
Work through what actually happens when one pair hits. Say you used the same password in 2016 on a hobby forum and on your personal email account, and the forum has just turned up in a dump.
Whoever gets in does not read your mail. They search it. Terms like welcome to, your receipt, verify your email and your account map out every service you have ever signed up for, in minutes. Then they use the feature every one of those services provides on purpose: the password reset link, delivered to the inbox they are already sitting in.
The next moves are standard. Add a hidden forwarding rule or a filter that sends anything containing the word security straight to the trash, so alerts never reach you. Change the recovery phone and backup address. Reset the accounts with money attached first, then the ones with stored payment cards, then the cloud drive holding scans of your passport and tax forms. That is the real cost of reuse: not one compromised forum login, but the entire set of accounts your email can unlock. Identity theft follows from the documents, not from the password, which is why the early signs of identity theft are worth recognizing.
Why adding a number does not count as a different password
The common compromise is a base password with a twist per site: the same word plus 1 for one account and 2 for the next, or the site name tacked on, or a capital letter moved around. It feels like variation. It is not.
Two different attacks eat it. Bulk stuffing tools apply a short set of mutation rules to every pair they own, exactly the same rules used for cracking: append a digit or a year, capitalize the first letter, add an exclamation mark, swap letters for lookalike numbers. Each rule costs one extra attempt per account, which is nothing. Separately, if anyone targets you specifically, your leaked passwords from three different sites sit side by side in front of them, and the pattern connecting them is obvious to a human in seconds.
The same logic explains why the strength of the individual password is beside the point here. Strength decides how long a stolen hash resists guessing, which is a different question, covered in what actually makes a password strong. Uniqueness decides how far one leak travels.
How to tell whether it has already happened
An honest answer first: a successful stuffing login often looks like you. Same password, ordinary browser, and if the attacker routed through an address in your country, nothing obviously strange for the service to flag. Absence of warnings is not evidence of safety.
The signals that do show up are worth knowing:
- Password reset emails you did not request, which usually mean someone has your address and is testing services.
- Sign in alerts from a device or city you do not recognize.
- Mail that should have arrived and did not, a sign of a filter or forwarding rule.
- A service telling you your password was found in a breach and forcing a change.
- Small unexplained charges on a card saved in an account, often used to test that the card works.
The direct check is better than waiting for signals. Breach notification services let you enter an email address or a password and see whether it appears in known dumps. How to check whether your password has already leaked walks through the safe way to do that, and what a data breach actually involves explains why a leak from years ago is still live ammunition today.
Unwinding reuse in one evening
You do not need to fix 200 accounts. You need to fix the ones that unlock other things, in order, and let the rest be handled over the following weeks as you sign into them.
| Order | Accounts | Why here | Do this as well |
|---|---|---|---|
| 1 | Primary email, and any secondary address used for recovery | It can reset nearly everything else, so nothing below is safe until it is | Sign out all sessions, check forwarding rules and filters, confirm the recovery phone and address are yours |
| 2 | Banking, payment apps, anything holding a balance | Direct loss, and reversals are slow and uncertain | Turn on transaction alerts and a second factor that is not SMS where possible |
| 3 | Accounts with a saved card or stored address: shopping, delivery, app stores | Fraud runs through these quietly, in small amounts | Remove cards you do not use, and check saved addresses |
| 4 | Cloud storage, photos, password manager, work accounts | They hold the documents used for identity theft and the keys to more | Review connected apps and devices with access |
| 5 | Social and messaging | Used to scam your contacts in your name | Check for unknown logged in sessions and linked apps |
| 6 | Everything else, as you next sign in | Low value on its own, but keeps feeding future lists | Let the manager generate a new password each time |
Do it with a generator rather than your imagination, because the point is that each new password is unrelated to the others. A password manager holding the whole set behind one vault is what makes uniqueness sustainable. The handful you still have to type from memory, starting with the vault itself, should be a random multi word passphrase rather than anything you invented.
While you are in each account, set up recovery properly: a current phone number, a backup address you still control, and saved backup codes. Doing that before you have a problem is the whole argument in setting up account recovery in advance, and it also removes the temptation to keep an old password because you fear being locked out.
What to do tonight
Give it an hour. Change your email password to something generated and unique, then sign out every other session and read the forwarding and filter settings line by line. Turn on two-factor authentication there, because a second factor is what stops a replayed password from working at all. Then do your bank.
After that, stop trying to remember passwords. Install a manager, let it flag the reused and leaked entries it finds, and clear a few every time you sign in somewhere. Reuse is not a moral failing, it is what happens when a person is asked to memorize a hundred secrets. The fix is to stop memorizing.
Common questions
Is it really that bad if I reuse a password on sites I do not care about?
It depends entirely on whether the email address is the same. Attackers match on the pair, so a throwaway account sharing your main email and your usual password hands over a working combination to test everywhere else. If you genuinely do not care about the account, it costs nothing to let a generator make the password, since you will never type it.
How do attackers get the password if the site hashed it?
Often they do not need to. Plenty of breached systems stored passwords in plain text or used a fast, outdated hashing method that falls to bulk guessing, especially for common passwords. Many credentials also never touch a breach at all, arriving instead from phishing pages or malware that copies everything saved in a browser.
Should I change every password after a breach notice?
Change the breached account and anywhere you used that same password, which is the part people skip. If the passwords were genuinely unique, one change is enough. Also check what else the breached service held, such as an address or a security question answer, since that information does not expire and can be reused against you later.
Does two-factor authentication make reuse safe?
No, it reduces the damage rather than removing it. A second factor blocks most automated logins with a stolen password, but not every account offers it, codes sent by text can be intercepted through SIM swapping, and a convincing phishing page can ask for the code in real time. Treat it as the second lock, not a reason to skip the first.