TL;DR: Reusing passwords is the single biggest reason one breach turns into many compromised accounts — every account should have its own password that isn't used anywhere else.
How to Create a Strong, Unique Password System — a clear, step-by-step guide to what to do and how long it takes.
Step 1: Use a unique password for every account
Reusing passwords is the single biggest reason one breach turns into many compromised accounts — every account should have its own password that isn't used anywhere else.
Step 2: Use a password manager
A password manager generates and stores strong, unique passwords for every site so you don't have to remember them all — you only need to remember one strong master password.
Step 3: Make passwords long rather than just complex
A long passphrase (several random unrelated words strung together) is generally both easier to remember and harder to crack than a shorter password stuffed with symbols.
Step 4: Never reuse your email password anywhere else
Since your email is often used to reset other accounts, its password should be the most unique and protected of all, and paired with two-factor authentication.
Step 5: Update passwords immediately after a breach notification
If a service you use reports a breach, or if a breach-checking tool shows your email or password was exposed, change that password right away, along with anywhere else you may have reused it.
If this looks similar to something else you've seen, it's worth reading How to Dispute a Fraudulent Credit Card Charge.
This pattern shows up elsewhere too — see How to File a Police Report for Identity Theft.
Frequently Asked Questions
Step 1: Use a unique password for every account
Reusing passwords is the single biggest reason one breach turns into many compromised accounts — every account should have its own password that isn't used anywhere else.
Step 2: Use a password manager
A password manager generates and stores strong, unique passwords for every site so you don't have to remember them all — you only need to remember one strong master password.
Step 3: Make passwords long rather than just complex
A long passphrase (several random unrelated words strung together) is generally both easier to remember and harder to crack than a shorter password stuffed with symbols.
Step 4: Never reuse your email password anywhere else
Since your email is often used to reset other accounts, its password should be the most unique and protected of all, and paired with two-factor authentication.
Step 5: Update passwords immediately after a breach notification
If a service you use reports a breach, or if a breach-checking tool shows your email or password was exposed, change that password right away, along with anywhere else you may have reused it.