How to stop reusing passwords
2 min read · Updated October 15, 2026
Start with email, banking and anything holding payment details. Install a password manager, let it generate a unique password for each account and replace reused ones gradually as you log in. Add two-factor authentication so that even a leaked password is not enough.
Why reuse is so dangerous
When one site is breached, attackers try the leaked email and password on other services. If you reused the password, they walk straight in. This credential stuffing attack is automated and cheap, which is why reuse is the biggest gap between a leak and a takeover.
A realistic plan
- ✓Week 1: fix email, banking, payment and primary shopping accounts.
- ✓Week 2: social media, cloud storage and work-related accounts.
- ✓Over time: replace others whenever you log in, using the manager’s generator.
Is your login already in a leak?
Strong habits help most when you know which accounts are already exposed. Check your email address for free.
Find the reused ones
Many password managers and browsers have a built-in audit that flags reused and weak passwords. Run it first so you know exactly where to start. A breach check on your email adds a second clue about which old accounts are exposed.
Make it stick
Let the password manager create passwords instead of inventing them yourself. Save everything as you go. Once the habit forms, new accounts are secure from the start.
Frequently asked questions
Is it OK to reuse a password on unimportant sites?+
It is better not to. Attackers use any leaked pair against important sites too, so reuse makes even small sites a risk.
What about a ‘base’ password with a site suffix?+
Attackers know this trick. If one version leaks, others are easy to guess.
Should I write passwords down?+
A locked-away paper list at home is safer than reuse, but a password manager is better.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.