Why Password Reuse is Dangerous
One Leak, Every Account
When you reuse a password across sites, a breach at any one of them hands attackers the key to all the others. This is one of the single biggest causes of account takeovers - and it has nothing to do with how strong the password itself was.
How It Actually Plays Out
Say you use the same password for a forum you signed up for years ago and for your email. The forum gets breached - it happens constantly, to companies of every size. Your email and password, sitting in that forum's database, are now in the hands of attackers, often bundled with millions of other stolen logins and sold or shared online.
From there, attackers run automated tools that take that same email-and-password combination and try it, at scale, against Gmail, banking sites, Amazon, and thousands of other services. This is called credential stuffing, and it doesn't require breaking anything - it just requires you having used that password somewhere else too.
If your email account is one of the ones it unlocks, the damage compounds fast: an attacker with access to your email can reset the password on nearly every other account you own.
Why This Bypasses "Strong" Passwords
This is the part that surprises people: password strength doesn't protect you here. A 20-character, perfectly random password is just as dangerous to reuse as a weak one, because the attacker isn't guessing it - they already have it, in plain sight, from the breach. See What is a Strong Password? for what strength does protect against, and why it's a separate problem from reuse.
Strength stops someone from guessing your password. Uniqueness stops someone who already has it from using it anywhere else.
Why People Reuse Passwords Anyway
Not carelessness - math. If you use a unique password for every account, and you have (realistically) dozens of accounts, that's dozens of passwords to remember. Human memory doesn't scale that way, so people fall back on a handful of passwords, or minor variations of one, reused everywhere.
This isn't a discipline problem to solve with willpower - it's a structural problem that needs a structural fix.
The Fix: Stop Being the One Who Remembers
The practical solution is to remove yourself from the "remembering" step entirely. A password manager generates and stores a unique password for every account, so reuse stops being tempting - you were never going to remember any of them anyway, so they might as well all be different.
Every time you create a new password with your Seedkeeper, it's generated fresh and stored on the device's secure element - never reused, never something you have to memorize. See Creating a New Password to try it.
Reuse Is an Organisational Problem Too
Everything above describes personal risk, but the same mechanism is one of the most common ways companies get breached.
An employee reuses a password between a consumer site and a work account. The consumer site is breached. The credentials circulate, get tried automatically against corporate services, and one of them works. No malware, no exploit, no sophistication - just a password that existed in two places.
This is why the EU's NIS2 directive treats access control and authentication as risk-management obligations rather than good practice. Article 21(2) lists them among the measures in-scope entities must adopt, and Article 21(2)(j) covers multi-factor authentication or continuous authentication specifically. Awareness training helps, but it asks people to sustain a discipline the human memory was never built for - which is why the durable fixes are structural: generated credentials that nobody memorises, and phishing-resistant authentication on privileged and remote access. See Why Hardware Keys for Your Business. See Passkeys and NIS2.
Passkeys Remove the Temptation Entirely
For your most important accounts, passkeys go a step further: they're cryptographically unique to each service by design, so reuse across sites isn't just discouraged, it's not technically possible. See What is a Passkey?.
FAQ
What is credential stuffing?
The automated technique of taking a leaked email-and-password combination and trying it across many other services at once. See How It Actually Plays Out above.
Does a strong password protect me from reuse risk?
No - strength and uniqueness protect against different threats. See Why This Bypasses "Strong" Passwords above.
How do I know if one of my passwords has already been leaked?
The reference service is Have I Been Pwned (haveibeenpwned.com), a free breach-notification database maintained by security researcher Troy Hunt and used by governments and browser vendors alike. Enter an email address and it tells you which known breaches it appears in. If yours shows up, treat that password - and every account still using it - as compromised.
Does password reuse at home put my employer at risk?
Yes, and it is one of the most common routes into a company. A personal account reused with work credentials means a breach at a consumer site can hand an attacker a corporate login. See Reuse Is an Organisational Problem Too above.
Is it enough to just reuse a password on "unimportant" sites?
Not really - many of those sites share your email address, which is often the real target. An attacker doesn't need your bank password if they can reset it through a compromised email account.