Home · Blog · Password reuse

Why reusing passwords is the fastest way to get hacked

2 Oct 2026 · Security · 7 min read

Here's a scenario that plays out thousands of times a day. A small forum you joined in 2019 gets breached. You haven't thought about that forum in years. Two weeks later, someone is reading your email. You never reused your important passwords — but the forum password was the same one you used for your email "just temporarily", and temporary became permanent.

This is credential stuffing, and it's the most common way accounts actually get taken over. Not sophisticated hacking, not zero-days — just trying your leaked password from one site on every other site, automatically, at scale. This article explains how it works, why it's so effective, and the one habit that defeats it completely.

How credential stuffing works

Breaches are routine. Databases of usernames and passwords — often millions of rows — circulate on criminal forums within days of a breach. The buyers aren't interested in the breached site itself; a database from a recipe forum is worth little on its own. What they're buying is password reuse: the well-documented fact that a large fraction of people use the same password, or small variations of it, across many sites.

The attack is embarrassingly simple to run. Automated tools take each email-and-password pair from the breach and try it against the login pages of banks, email providers, social networks, shopping sites and anything else valuable — thousands of attempts per minute, distributed across botnets to dodge rate limits. When a pair works somewhere, that account is flagged as compromised and either drained directly or sold onward.

The economics are what make it unstoppable at the source. The attacker needs only a tiny hit rate. If 0.5% of a ten-million-row breach database yields a working login on a valuable site, that's 50,000 accounts. The marginal cost of each attempt is essentially zero, so even absurdly low success rates are profitable. Defenders, meanwhile, have to block 100% of attempts to be safe — the classic asymmetry of security.

Why it's so effective against real people

Password reuse isn't laziness; it's a rational response to an impossible demand. The average person has well over a hundred online accounts. Memorising a hundred unique, strong passwords is not a thing human brains do, so people cope: one "good" password for important sites, one "okay" password for everything else, maybe with a digit or symbol tweaked per site.

The problem is that attackers model exactly these coping strategies. The variations people use are predictable:

• Site-specific tweaks — Sunshine2024! becomes Sunshine2024!fb for one site and Sunshine2024!gm for another. Attackers' tools generate these mutations automatically.
• Incrementing digits — when forced to change a password, most people bump the number: ...2023 becomes ...2024. Guessers try the neighbours.
• Capitalisation patterns — first letter capitalised, maybe a trailing exclamation mark. These are the first mutations in every password-guessing ruleset.

Studies of breached password databases consistently find that a huge share of passwords fall to these simple transformations. Your "system" for varying passwords is almost certainly one that attackers have already encoded into their tools.

The blast radius of one breach

Think about what your email account protects. It's not just email — it's the recovery address for nearly everything else. With access to your inbox, an attacker can trigger "forgot password" flows on your bank, your shopping accounts, your social media, and reset each one in turn. Security researchers call email the "skeleton key" account for exactly this reason.

Now trace the chain from a single reused password:

1. A low-value site (forum, newsletter, free game) is breached. Its security was mediocre — that's why it got breached.
2. Your email + password pair from that site is sold in a combo list within days.
3. Automated stuffing tries the pair against major email providers. It works — you reused the password "just for now".
4. The attacker searches your inbox for "welcome", "verify", "receipt" to map your accounts, then resets passwords everywhere via email recovery.
5. Within hours, the attacker owns your digital life. The original breached site is a distant memory.

This chain needs no skill beyond running someone else's tooling, and step 1 — the initial breach — is entirely outside your control. You cannot prevent sites from being breached. You can only make sure a breach of any one site doesn't cascade into the others. That's what unique passwords buy you: containment.

The one habit that stops it

Every site gets its own random password, stored in a password manager. That's the whole habit. It directly breaks the attacker's business model: a breached password is useful only against the breached site, and the stuffing tools find nothing anywhere else.

Getting there is a one-time project, not a lifestyle change:

• Install a password manager (reputable options exist on every platform, many free). This is the single highest-leverage security action most people can take.
• Change your email password first — to something long, random and unique. Your email is the skeleton key; secure it before anything else, and turn on two-factor authentication for it.
• Work through important accounts next: banking, shopping with saved cards, social media, work accounts. Generate a fresh random password for each with the Password Generator — 20 characters from the full character set is a comfortable default.
• Don't try to do all hundred at once. Change passwords as you naturally visit sites. Within a few months, the important ones are unique and the long tail follows.
• Check past exposure: services like Have I Been Pwned let you check whether your email appears in known breaches. If it does — and for most people it does — treat every password you've ever reused as compromised and rotate the important ones first.

What about the passwords you must memorise?

You can't put your password manager's master password in the password manager. For the two or three secrets a human must actually remember — the manager's master password, your device unlock, maybe your email — use a long passphrase of 6–8 randomly generated words. It's the one place where memorability matters, and a proper random passphrase is both strong and learnable. Everything else goes in the manager as random characters you'll never look at.

The longer-term fix: passkeys

There's a technology that removes the password-reuse problem at the root: passkeys. Instead of a shared secret you type, your device holds a cryptographic key pair and proves possession of the private key during login — nothing to memorise, nothing to reuse, nothing phishable in the traditional sense. Each site automatically gets its own key, which is exactly the "unique per site" property this article argues for, enforced by mathematics rather than discipline. Adoption is growing: major platforms and a lengthening list of sites support them, and password managers now sync them across devices. Passkeys won't replace passwords overnight — recovery flows and cross-device quirks are still being ironed out — but the direction is clear. Until your important sites support them, unique random passwords in a manager remain the practical defence. Think of passkeys as the future arriving gradually, not as a reason to postpone the habit that works today.

An honest caveat

Unique passwords contain breaches; they don't prevent every attack. Phishing steals even unique passwords, malware on your device sees what you type, and a breached site can still leak your personal data regardless of password hygiene. Unique passwords are the foundation, not the whole building — two-factor authentication on important accounts is the next layer, and it matters precisely because passwords alone, however unique, can still be phished. But without unique passwords, you're skipping the foundation entirely, and no upper layer compensates for that.

Try the Password Generator