Why Password Reuse Is the Real Risk (and How a Manager Fixes It)

The way most people get hacked is not a movie-plot zero day. It is a reused password. A breach at one site leaks a list of username and password pairs, and attackers run that list against every other site they can find, knowing that a meaningful fraction of users used the same combination in more than one place. The attack is called credential stuffing, it is almost entirely automated, and it works because of human memory, not because of weak cryptography.

Why reuse is the failure mode

A password's job is to be a secret between you and one service. The moment a secret is shared across services, it stops being a secret and starts being a key that opens several doors. Breaches are not rare events; large credential dumps circulate publicly, and a single dump can contain hundreds of millions of pairs.

The attack that follows is mechanical. An attacker takes a leaked list, feeds it into an automated tool, and tries every pair against login endpoints at banks, email providers, social networks, and shopping sites. The hit rate is low, often a percent or two, but on a list of fifty million pairs, one percent is half a million compromised accounts. Sites that enforce rate limits and bot detection blunt the attack; sites that do not, do not.

The defence is not a cleverer password. It is a different password for every account, which is mathematically more work to remember the more accounts you have. That is the entire problem a password manager exists to solve.

What a password manager actually does

A password manager stores credentials for each account in an encrypted vault and fills them in on the right pages, so the cost of having a unique password per site drops to roughly zero. You stop memorizing passwords and start memorizing one: the master password that unlocks the vault.

• It generates long, random passwords that have no structure for an attacker to guess: no dictionary words, no dates, no keyboard patterns.
• It only ever submits a credential on the legitimate domain, which makes basic phishing pages useless, because the manager does not recognize a lookalike domain as the real one.
• It audits the vault over time and flags reused, weak, or previously breached passwords so they can be rotated.
• It syncs across devices through a provider that has had its threat model reviewed, which for most people is safer than the alternatives (a notes file, a browser that does not sync, a sticky note).

The generation step is the part a manager automates but that you can also do by hand. The password generator produces a random string of configurable length and character set, and the password strength checker gives an estimate of how many bits of entropy a given password actually carries.

The master password is the one that matters

Because the vault is encrypted with a key derived from the master password, that single password now protects everything else, and it has to be strong and never reused anywhere. A weak master password undoes the entire benefit of the manager. The standard advice is a long passphrase, four or five unrelated words strung together, which is easier to type and remember than a random string while still carrying enough entropy to resist offline guessing.

Example entropy (approximate):
4 random lowercase words        ~52 bits
5 random lowercase words        ~65 bits
12-char random mix (all sets)   ~78 bits

The vault itself should be backed by a second factor wherever the manager supports it, and the recovery codes printed and stored somewhere physical and safe. Losing the master password with no recovery path means losing the vault, which is a real and underappreciated risk. A printed backup of the recovery code in a drawer is the boring, correct mitigation.

What this changes about the threat model

With a manager in place, the failure modes shift. A breach at one site leaks one password, which the manager will tell you to change, and nothing else. Phishing becomes harder because autofill does not fire on lookalike domains. The remaining real risks are the master password itself and the manager provider, both of which are a better trade than the alternative of using the same password everywhere.

None of this requires paying for a particular product. Reputable free managers exist, browsers ship with one built in, and the marginal security gain of a paid product over a free one is usually smaller than the gain of using any manager over none. The decision that matters is adopting one at all; which one is a secondary question.