If you use the same password (or a small variation of it) across multiple sites, you’re not alone. It’s one of the most common security habits there is. It’s also one of the most dangerous. The fix is easier than you might think.
Why reused passwords are a problem
Websites get breached all the time. When one does, attackers take the leaked email-and-password pairs and automatically try them on other sites: email, banking, shopping, social media. This is called credential stuffing, and it works because so many people reuse passwords.
A strong password on a site that gets breached is still exposed. The only real protection is a unique password for every account.
Step 1: Check if you've been exposed
Visit haveibeenpwned.com and enter your email address. It shows which known data breaches included your account. Many password managers and browsers also warn you about leaked passwords automatically.
Step 2: Get a password manager
Nobody can remember 100 unique passwords, and you don’t need to. A password manager:
- Generates strong, random passwords.
- Stores them securely behind one master password.
- Fills them in automatically on the right sites. This also helps protect you from fake login pages, because it won’t autofill on a lookalike domain.
Options include your browser’s or operating system’s built-in manager (Apple Passwords, Google Password Manager, Microsoft Edge) or dedicated apps like Bitwarden, 1Password or Proton Pass.
Your master password should be long and memorable: a passphrase of four or more random words works well. Never reuse it anywhere.
Step 3: Turn on two-factor authentication (2FA)
Two-factor authentication means that even with your password, an attacker can’t log in without a second proof, usually from your phone.
Options, from strongest to weakest:
- Passkeys or security keys: resistant to phishing, and increasingly supported.
- Authenticator apps: Microsoft Authenticator, Google Authenticator, or the one in your password manager.
- SMS text codes: better than nothing, but vulnerable to SIM-swap attacks.
Start with your email account. Your email can reset every other password, so it’s the most important account you own. Then do banking, your Apple/Google/Microsoft account, social media and shopping sites.
Save your backup codes when you set up 2FA. Store them somewhere safe, like in your password manager or printed and filed away, so you’re not locked out if you lose your phone.
Step 4: What about passkeys?
Passkeys are replacing passwords on many major sites. Instead of typing a password, you confirm with your fingerprint, face or device PIN. They can’t be phished or reused, so when a site offers passkeys, it’s worth switching.
Step 5: Fix passwords gradually
You don’t need to change everything today. A practical order:
- Email accounts
- Banking and financial accounts
- Apple, Google or Microsoft account
- Social media
- Everything else, as you log in to it
The bottom line
A password manager plus two-factor authentication on your important accounts blocks the vast majority of account takeovers. Set aside an afternoon, start with your email, and you’ll be far safer than most people online.
