Account takeovers are rarely dramatic. More often, someone guesses a password, or tries one that leaked in an older breach and finds it still opens the door somewhere else. That is why password habits matter more than strength meters: a decent password reused twice is a weak password. Below are the mistakes that cause the most damage, and the fixes — most of which fit into a single afternoon.
1. Reusing the same password on more than one account
Your email password is the master key to your online life. If it also unlocks your bank, your cloud storage and a shopping site, one leak anywhere becomes a problem everywhere. Leaked email-and-password pairs get traded and tested against login pages automatically, in bulk, for years after the original breach. It is not personal; it is mechanical.
The fix: give every account its own password, starting with the ones that matter most — email, banking, work, and anything that stores a card number. If that sounds like too much to remember, that is exactly the problem a password manager solves. Unique passwords also contain the damage: one breach stays one breach.
2. Building passwords from personal details
Names, birthdays, anniversaries, pet names, house numbers, the football club you post about every weekend. These feel private and are not. People who know you can guess them, and anyone who reads your public profiles can build a shortlist in minutes. Sofia2016! looks clever until your social feed is a timeline of exactly that information.
The fix: personal details can appear inside a longer passphrase, but they should never be the whole thing, and never the part that makes it guessable. Better still, keep names and dates out of passwords entirely and use them only as memory triggers for something else.
3. Keeping passwords short and easy to type
Length is the single biggest factor in how long a password resists guessing. Eight characters with a capital and a symbol is still short. And the usual tricks — swapping a for @, o for 0, e for 3, then adding 1! at the end — follow patterns that cracking tools already expect. Rules that demand a symbol and a number often push people toward exactly those predictable shapes.
The fix: aim for sixteen characters or more, and build it from unrelated words. tidal-piano-copper-heron is long, easy to type, and far harder to crack than Tr0ub4dor!. Four random words beats one mangled word every time. If a site caps password length, use the longest string it allows.
4. Storing passwords where anyone with your phone can find them
A note called “Passwords”. A spreadsheet in cloud storage. A photo of a handwritten list. A message you sent yourself so you would not forget. Each of these turns a single moment of access — a lost phone, a borrowed laptop, a compromised email account — into a complete inventory of everything you own online, neatly labelled with where to use it.
The fix: use a password manager. Paper in a locked drawer is safer than a synced note, but it does not travel well. If you would rather not start with a dedicated app, your phone's built-in keychain or your browser's saved passwords are still better than plain text — as long as the device has a screen lock and a PIN that is not your birth year.
5. Sharing passwords freely and freezing after a breach
Sharing a streaming account, a work tool or a Wi-Fi code through chat leaves that password in the conversation history forever. Then there is the breach email: a company writes to say an incident exposed account data, and many people read it, feel uneasy, and change nothing — or change that one password while identical copies sit on a dozen other sites.
The fix: use the sharing features services provide, such as family plans and separate profiles, instead of passing one login around. When a breach notice arrives, change that password first, then change every other account that used it. With unique passwords everywhere, this becomes a two-minute task instead of a week of worry.
The fix in practice: passphrases and a manager
Build a passphrase you can remember
Pick four or five unrelated words, join them with hyphens, and make it long. Save the creative effort for your master password, which should be the strongest one you have and should exist nowhere else. A short phrase you can type without thinking is fine; a clever pun you have to look up is not.
Let a manager do the remembering
A password manager generates long random strings, fills them in automatically, and syncs across your devices. Set it up once and you get:
- a different password for every account, without memorising any of them;
- a warning when your saved logins appear in a known breach;
- autofill that keeps you from typing credentials into lookalike sites;
- one master password to protect, plus a printed recovery code stored somewhere physically safe.
Whichever manager you choose, turn on two-factor authentication for both the manager and your email. Codes from an authenticator app or a hardware key are stronger than text messages, though an SMS code is still better than nothing at all. For banking and payment accounts, follow your bank's own security guidance — many now support passkeys or in-app confirmation, and that guidance always takes priority over general advice.
Your first hour of cleanup
You do not need to fix everything today. Pick the accounts that could ruin your week and work through this list once:
- Change your email password, and make it unique and long.
- Turn on two-factor authentication for email, banking, and your main cloud account.
- Install a password manager and import whatever is saved in your browser.
- Replace the passwords on your five most important accounts with generated ones.
- Delete any password notes, screenshots or chat messages once each login is safely stored.
- Print the manager's recovery code and put it somewhere a burglar would not look.
After that, you only have to keep one habit going: when you create a new account, let the manager invent the password. It takes five seconds, and it closes a door attackers rely on staying open.
Photo: Jakub Zerdzicki / Pexels
