You use the same password everywhere?

The problem

Remembering a different password for every account is difficult. Reuse feels convenient, but a stolen sign-in can be tried on other websites. This is called credential stuffing.

A breach may expose readable passwords or their hashes. A stolen hash is not automatically a readable password: recovering it depends on the password and how the service stored it.

A strong, usable sign-in

Choose passwords that are unique, long and random. Aim for 16 characters or more where supported. A passphrase can use several randomly selected words; a familiar quotation or words chosen from your life are more predictable.

Passphrase words can come from a dictionary: their random selection and number matter. Adding “!” to a common word is not enough. Do not reuse the examples published on this site for an account.

A password manager generates and stores these values. A passkey, where supported, provides another way to sign in without typing a password.

What to do now

Step 1: Start with your email

Open your email settings through its usual app or address. Your inbox receives recovery links for other accounts, so protect it first. Follow the guided path if you would like help getting started.

Step 2: Replace a reused password

Generate a unique value in your manager, save it, then change the account password. Check that the saved entry matches the correct site. Next, add sign-in protection using the authentication module.

Step 3: Work through other accounts

Continue with financial accounts, cloud storage and social media. If you receive a breach alert, verify it directly with the provider. Replace affected passwords, including wherever you reused them.

Have I Been Pwned searches an email address in breaches it knows about. A result identifies known exposure; no result does not prove an account is safe. This check takes place on an external service.

---

Go further

Hashing and password theft

Hashing is not encryption that can be decrypted with a key. An attacker tests candidates and compares hashes. Appropriate storage, using a salt and a costly password hashing function, slows this process. Unique passwords also limit damage from a breach at another provider.

Change passwords for a reason

Change a password that is exposed, reused or predictable. For personal accounts, arbitrarily changing a strong password every month matters less than uniqueness, additional sign-in protection and prepared recovery. Follow your organization’s specific requirements for work accounts.