Why Your Password Isn’t the Problem (Reuse Is)

Imagine you had one key. Just the one. It opens your front door, your car, your desk at work, your gym locker, and a storage shed you rent from a bloke called Dave who advertises on a laminated sign.

Now: how much time should you spend making that key more intricate?

None. The shape of the key is not your problem. Your problem is that you gave a copy to Dave, and Dave keeps his spare keys in a biscuit tin.

That is password reuse, and it is the reason ordinary people lose their accounts. Not weak passwords. Not clever hacking. A copy of a perfectly good key, sitting in someone else’s biscuit tin.

The advice you were given is answering the wrong question

Every password rule you have ever been nagged about is about strength. Make it longer. Add a symbol. Don’t use your dog’s name. Change it every ninety days because a compliance document from 2003 said so.

All of that is defending against someone sitting at a keyboard trying to guess their way in. Which does happen! It is just not what happened to your cousin’s Instagram.

What happened to your cousin’s Instagram is that they used the same password on a fantasy football site, the fantasy football site got breached, and a script tried that password on forty other services while everyone was asleep.

Here is the part that stings: a twenty-character passphrase with three symbols in it is exactly as compromised as hunter2 the moment it turns up in a breach. Strength buys you nothing against an attacker who already has the answer written down. You cannot out-complicate a leak.

Watch it happen

Four stages. Notice that your account doesn’t appear until stage three, and you have no ability to influence stages one or two at all.

1. Step 1 of 4

   A site you barely remember gets breached

   Not your bank. A forum you joined in 2017 to ask one question about a router. A shop you used once for a birthday present. Its database gets copied, and often nobody tells you — sometimes because nobody noticed.

2. Step 2 of 4

   The stolen passwords are turned back into text

   If that forum stored passwords badly — as plain text, or behind an old fast hash like MD5 — most of them become readable in an afternoon. What comes out the other side is a list of email-and-password pairs that are known to work.

3. Step 3 of 4

   Your pair gets tried absolutely everywhere else

   Software replays that exact email and password against hundreds of other services — Gmail, Amazon, your bank, your employer’s VPN. Nothing is being guessed here. Your password is simply being used, correctly, by someone who is not you.

4. Step 4 of 4

   One of them opens

   One match is enough. And if the one that opens is your email account, it is game over for the rest — because your inbox is where every "reset your password" link in your life gets delivered.

What actually leaks when a site gets breached

This bit is worth understanding properly, because it determines whether you have a problem or a problem.

When you sign up somewhere, a decent site doesn’t store your password. It stores a scrambled fingerprint of it — a hash. When you log in, it scrambles what you typed and compares fingerprints. Get breached, and the attacker gets fingerprints, not passwords. In theory.

In practice, it depends entirely on how the site did it:

Plain text. They just… saved it. As you typed it. Nothing to crack, nothing to do, everyone’s password is right there in a spreadsheet. This still happens in 2026 and it will still be happening in 2036.

A fast hash (MD5, SHA-1, unsalted SHA-256). These were built for speed, which is a wonderful property for checking file integrity and a catastrophic one here. A gaming graphics card can test billions of guesses a second against a fast hash. Common passwords fall before you’ve finished reading this paragraph. Most of the rest fall over a weekend.

A slow, salted hash (bcrypt, scrypt, Argon2). Deliberately, expensively slow — we’re talking a fraction of a second per guess instead of a billionth. That turns “a weekend” into “several centuries”. The salt means every password has to be attacked separately, so the attacker can’t do them all at once.

Now, the question that matters: which one did that 2017 router forum use?

You have absolutely no idea. Neither do I. And that is the whole point —

When you reuse a password, you are trusting the engineering standards of every website you have ever signed up to, all at once, forever.

You are outsourcing the security of your bank account to a hobbyist forum admin who last updated the login code during the Obama administration.

The arithmetic nobody wants to do

Let’s say you use roughly the same password across twelve services. People usually guess “twelve” and then admit it’s more like thirty.

Your risk isn’t “what are the odds my password gets cracked?” It’s “what are the odds that at least one of these twelve places gets breached and stored it badly?”

Any single site might be a 5% risk over a decade. Fine. But you’re not rolling one die, you’re rolling twelve. The chance that none of them comes up is 0.95¹², which is about 54%. So it’s a coin flip — and that’s with a generous 5% and a modest twelve. Push it to thirty accounts over fifteen years and you are no longer flipping a coin. You are waiting for a bus that has already left.

Now flip it round. Twelve different passwords. A breach at the forum exposes… the forum. There is nothing to replay. Nothing to try elsewhere. The damage stops at the door it came through.

That’s the entire argument, and it has nothing to do with entropy:

Unique passwords don’t reduce the chance of a breach. They reduce the blast radius of one.

You cannot stop other companies being careless. You can stop their carelessness from becoming yours.

Why the old rules made everything worse

Here’s the genuinely funny part. Complexity rules and forced 90-day changes actively caused reuse.

Tell a human their password needs a capital, a number, and a symbol, and you will receive Password1!. Tell them to change it every quarter and you will receive Password2!. And because they now have one thing they can just about remember, they will use it absolutely everywhere, because inventing another one is not happening.

Security teams spent twenty years optimising a variable that didn’t matter, and in doing so pushed everyone straight into the failure mode that did.

Both NIST in the US and the NCSC in the UK have since reversed this advice. Current guidance drops mandatory composition rules and scheduled expiry, and leans instead on length, blocking known-breached passwords, and — the real insight — not asking humans to memorise things at all.

What actually works

Get a password manager. Use a different password everywhere. That’s it. That’s the fix. Everything else on this page is commentary.

You don’t remember any of them, so they can be forty random characters. You remember exactly one strong passphrase, for the manager itself.

The objection is always the same, and it deserves a straight answer:

“Isn’t that putting all my eggs in one basket?”

Yes. And you should, because you already have one basket — it’s the password you reuse, and it’s currently made of wicker and sitting in the rain. The difference is that a password manager’s basket is encrypted with a key that never leaves your device, and it doesn’t get automatically tried against three hundred websites every time some company has a bad Tuesday.

A pleasant side effect nobody mentions: your manager only offers to fill in passwords on the domain it saved them for. So if you land on a very convincing copy of your bank and the manager sits there doing nothing, that silence is a warning. It has quietly caught a phishing attempt that your eyes were about to miss.

Turn on passkeys wherever they’re offered. A passkey isn’t a password at all — it’s a key pair, where the secret half never leaves your phone or laptop and is mathematically welded to one specific website. There’s no reusable secret, so there’s nothing to leak, nothing to replay, and nothing to type into the wrong box. Most big providers support them now and it’s usually one screen in your settings.

Go and check if you’re already in a breach. Have I Been Pwned will tell you which known breaches include your email address, free, in about ten seconds. Everyone should do this once. Then — and this is the step people skip — change that password everywhere you used it, not just on the site that leaked.

Fix your email account first. Not your bank. Your email. Whoever controls your inbox can click “forgot password” on every other service you own and simply collect the links. It is the master key to your entire life, and most people protect it worse than their Netflix.

The one thing to take away

Stop grading your passwords. Start counting them.

If you have more accounts than you have distinct passwords, that gap is your exposure — and no amount of exclamation marks closes it.

So this week: install a password manager. Change your email password first. Then work outward, doing the important ones as you naturally log into them. You don’t have to fix thirty accounts on a Sunday afternoon. You just have to stop handing out copies of the same key.

Dave means well. Dave’s biscuit tin is not a security control.