I strongly advise you not to re-use passwords
This is probably the most important piece of cyber-security advice there is. This post explains how dangerous the practice of re-using passwords actually is, and how easy it is to stop doing it.
Why is it dangerous to re-use passwords?
Your account username and the password you re-use can be revealed in a data breach. You have absolutely no control over this happening – none whatsoever.
Once this has happened, the password for all those other sites is now “out there” for criminals to buy and sell, and then to gain access to your other accounts.
What happens after a data breach?
- Your username and password combination goes up for sale on the dark web
- Cybercriminals (maybe many different ones) buy your data
- They use software to try the same data on hundreds (or maybe thousands) of other websites where you might have used the same password. This practice is called “credential stuffing”
- At every site where they find a match they can access your account and cause untold financial, legal, and administrative turmoil
- As soon as you become aware of a breach, you not only have to sort that out, but you now have a race against time to change the passwords on all the other sites that you now know for certain are vulnerable to credential stuffing (assuming you can remember which sites they are)
Your problem: you can’t possibly keep track of unique passwords
This is a common theme I often hear from many of my own IT Support clients.
For instance, a client told me recently that she has to deal with 100 online businesses and couldn’t possibly have different passwords for each account. She does not think she could cope with a password manager (the only real solution). Therefore, she has been using the same password for all the accounts.
None of us can remember all the passwords we need to be able to access at the drop of a hat. There’s no point in trying. There are just too many passwords to remember them all.
That means we have to find a better method of accessing passwords that doesn’t rely on our memory.
Three Solutions (in descending order of desirability)
1) Password Managers
Online password managers can create unique passwords. synch your passwords to all your devices, auto fill website forms, stop you using weak passwords, and much more, However, some people find them difficult to cope with and others don’t trust them. Some of the best are from Nordpass , Dashlane, BitWarden.
A client of mine recently recommended the password manager now included in iPhones. It’s very easy to use. This is my blog post on this – “iPhone Passwords app“.
2) Make your own password manager
I, myself, have blogged that a compromise if you don’t want to use a password manager is to create an encrypted Word or Excel data file (or any other data file that you can encrypt yourself). See “Create your own simple Password Manager“. Do not, under any circumstances, save passwords in an unencrypted file. And for goodness sake, please don’t do what I caught one client doing – emailing passwords to herself.
3) The simplest solution – write them down
I would not recommend writing passwords down in a book that you carry around with you. To my mind, though, writing down passwords and keeping them in a relatively safe place is not such a big risk when compared with the risk of re-using just one or two remembered passwords.
But what if I’m burgled? Burglars want physical things they can easily sell. They haven’t burgled you for your passwords.
How can I possibly change all the accounts I have by giving them unique passwords?
Bit by bit. Change the most important ones first – eg financial accounts, email passwords, For this kind of boring IT task, I set myself a schedule – say 20 minutes a day, or change 5 passwords per week, for instance.
This is not an overnight job, but the sooner you start, the better protected you will be.
You will reduce the risk you are running a bit further every time you replace a re-used password with another unique one.
I can’t cope with that. The risk of re-using passwords can’t be that great, can it?
Yes – it most certainly can. The risk of re-using passwords is huge.
Let us examine it using the standard measure of risk as being “Likelihood” multiplied by “Impact”,
Consider my client with 100 online accounts with different businesses:
The likelihood of her re-used password featuring in a data breach is not far short of 100 times the likelihood of any unique password being revealed.
The impact of having all 100 accounts hacked (financial, legal, administrative, etc) is also somewhere in the region of 100 times the impact of a single breach.
Therefore, the risk of my client re-using a single password in her 100 accounts could be up to 100 x 100 = 10,000 times the risk of using unique passwords.
Is it really worth taking a risk that big?
Some hints for creating unique passwords and writing them down
Good practice for creating unique passwords
- An absolute minimum of 10 characters, but the more the merrier
- Always include at least one each of upper and lower case letters, a number, and another character
- Do not have just one password and add numbers to the end – such as “Tiddles1”, “Tiddles2”. The bad guys know all those tricks.
- Likewise, don’t bother thinking that substituting letters will fool anyone (eg “M@r1@nne”). It won’t.
- Don’t use relatives’ or pets’ names or other personal information – you may have revealed more than you think on social media.
If you are recording passwords manually I recommend including:
- What it is (eg “Microsoft account”)
- Username (even if it’s your only email address, write it down)
- Password (natch)
- Current Date (so that you are sure which of several similar records is the most recent)
Some more relevant links about using passwords
- Has your email address cropped up in a data breach?
- More about password hygiene
- Top 200 most common passwords – avoid using them
PS: now you know why your antivirus program has started telling you when your data has appeared on the dark web. It’s to give you a heads up so that you can change the password wherever else you’ve used the one that’s now for sale.
This blog post was fact-checked by Gemini on 17/07/2025
All images designed by David Leonard with Microsoft Designer
