Why You Should Never Reuse Passwords

The scale of the problem

Have I Been Pwned (haveibeenpwned.com), the most comprehensive public breach database, contains more than 17 billion compromised email addresses from over a thousand breached websites as of 2026. Separately, the RockYou2024 compilation holds nearly 10 billion unique plaintext passwords. These credentials come from breaches spanning two decades. Every time a website is breached and credentials are leaked, those credentials join this pool and are immediately available to anyone who wants to use them for attacks.

How credential stuffing exploits reuse

Credential stuffing is an automated attack that takes known username/password pairs from breaches and tests them against other websites. It works entirely because of password reuse. If you use the same password on ten websites and one is breached, an attacker can immediately test your credentials against the other nine automatically. Automated tools such as OpenBullet can test large lists of credentials against many sites with little effort. Commonly cited success rates are roughly 0.2–2% — meaning that from a list of 10 million credentials, 20,000–200,000 accounts could be compromised in a single campaign.

Why you cannot predict which breach will hit you

You do not get to choose which websites are well-secured and which are not. Small forums, niche shopping sites, apps you signed up for years ago — any of them can be breached, and many have been. You also cannot predict timing: old leaked credentials continue to be tested against new sites years later. A breach you have forgotten about can compromise a new account you created today, if they share the same password.

The cascade effect of a single shared password

Consider what happens when an attacker tests your email and password from a 2019 forum breach: they try it on Gmail, Outlook, Yahoo. If it works on your email, they have the ability to reset every other password you have ever set — banking, social media, work accounts. The original breach of a low-value site cascades into total account compromise. Email accounts are the master key; if they fall, everything falls.

What uniqueness actually means in practice

Unique does not mean you need to remember a different complex string for every site. It means no two sites share a password. A password manager generates and stores unique passwords automatically. You generate one, save it, never see it again, and the manager fills it in when needed. You maintain exactly one thing: the master password that unlocks the manager. Every other credential is unique, random and stored securely.

The one rule that eliminates credential stuffing

Credential stuffing is entirely dependent on password reuse. Remove the reuse and the attack model collapses: a breached password from Site A is only useful on Site A. The attacker cannot use it elsewhere because no other site has that password. This is not a marginal security improvement — it is the single most impactful change most people can make to their online security. Use a password generator to create unique passwords. Use a password manager to store them. The combination makes credential stuffing attacks irrelevant to you entirely.

How reuse sneaks in

Reuse is rarely a deliberate decision. It creeps in through small variations: adding a number to the end of a favourite password, slotting a site name into a fixed pattern, or recycling an old password when a site forces a reset. These tweaks add very little protection, because attackers test predictable variations of a leaked password as well as the original. Treat any password derived from another one as reused.

What to do if you have already reused passwords

Start with the accounts that matter most: your main email, financial accounts, and anything that can be used to reset other accounts. Change each one to a unique generated password and switch on multi-factor authentication where it is offered. Then work through the rest gradually, using Have I Been Pwned to prioritise any account tied to an address that appears in a known breach. You do not have to fix everything in one evening; securing the highest-value accounts first removes most of the risk.

Reuse between work and home

Reusing a personal password for a work account is especially risky, because a breach of an unrelated personal service can become a way into your employer's systems. The reverse is just as true: a work password has no place on a personal site. Many organisations require unique passwords for this reason, and a password manager makes that requirement easy to meet without memorising anything extra.