Most people I help with a hacked account aren't using a weak password. They're using a decent one, the same one they've used for ten years, on their email, their Amazon, their bank, the local GAA lotto site and a forum they joined in 2014.
That last one is the problem. Somewhere along the line, one of those smaller sites gets breached. The email and password go into a list. And then software tries that same pair on every big service going, thousands of times a minute. It's called credential stuffing, and it doesn't care how clever your password is.
The numbers behind it
Verizon's Data Breach Investigations Report is the one the security industry waits for every year. This year's edition found stolen or abused logins played a part in 39% of breaches. It also found something that surprised me: people are more than four times as likely to be using a password that has already leaked than one that's simply too weak.
That last figure is the one I'd want every business owner to see. Nearly three in four ransomware victims had passwords leaked or stolen by malware in the year before the attack, and half of those within about three months of it. The leak is the warning shot.
What makes a good password
Forget the old rules about a capital letter, a number and a symbol. Pa$$w0rd1! ticks every box and gets cracked in seconds, because attackers know those swaps too.
The UK's National Cyber Security Centre recommends three random words joined together. Something like kettlesilagecomet. It's long, which matters far more than symbols, and it's something a human can actually remember. Avoid anything about you: kids' names, pets, the county team, your birthday. That's all on Facebook.
Trouble is, even if you pick a great three-word password, you still can't remember a different one for every account. Dashlane's research puts the average person at around 300 passwords. Nobody holds that in their head. Which is why people reuse, and why reuse is where it all goes wrong.
A password manager fixes the actual problem
A password manager is an app that remembers your passwords for you, makes up a new random one for each site, and fills it in when you log in. You remember one strong password (the master password) and it handles the rest. It works across your phone, laptop and browser.
Without one
One password, give or take a number on the end, used on dozens of sites. A breach anywhere is a breach everywhere. Changing it means changing it in thirty places, so nobody does.
With one
A different long random password on every site. A breach at one shop exposes one account, and you change one password. Logging in is actually quicker, because it fills itself in.
Which one to pick
Don't overthink this. Any of the well-known ones is far better than reusing passwords.
| Bitwarden | Free version is excellent. Open source |
| 1Password | Paid. Very polished, good for families and teams |
| Apple Passwords | Built in on iPhone and Mac. Fine if you're all-Apple |
| Google Password Manager | Built into Chrome and Android. Fine if you're all-Google |
The built-in ones are a good start, and much better than nothing. Where they fall down is when your household or business mixes iPhones, Android and Windows. That's when a standalone one like Bitwarden or 1Password earns its place. One more thing: if you were using Microsoft Authenticator to store passwords, Microsoft removed that feature in 2025 and moved them into the Edge browser, so check they came across.
"Isn't that all my eggs in one basket?"
It's the question I get every time, and it's fair. Yes, it's one basket. But it's a basket with a very good lock, versus thirty baskets that all open with the same key.
The best-known case is LastPass, which was breached in 2022. Attackers got copies of customers' encrypted vaults. People with a long, unique master password were protected by the encryption. People with a short master password were at real risk, because it could be guessed offline at leisure. So keep using a manager. Make the master password long, use it nowhere else, and turn on two-step verification.
Setting one up in an evening
Pick one and install it
On your phone and as a browser extension on your computer. Same account on both.
Make a strong master password
Three or four random words. Write it down and keep it somewhere safe at home, not on your desk. Turn on two-step verification for the manager itself.
Import what your browser saved
Most managers can pull in passwords Chrome, Edge or Safari already stored. Then switch off the browser's own saving so you don't end up with two lists.
Fix the big five first
Email, bank, PayPal or Revolut, Amazon, and Facebook or your main social account. Give each a new random password from the manager. Email goes first, because it's the key to resetting everything else.
Do the rest as you go
Every time you log in somewhere, let the manager change that password. Within a couple of months, the old one is gone.
Where a site offers a passkey, take it. A passkey can't be reused or phished, and most password managers store them now. I covered how they work in my post on passkeys.
For businesses
- Use a business plan with shared vaults. The shared Wi-Fi, the supplier portal, the social accounts: each goes in a shared folder only the right people can see. No more passwords on a sticky note by the till.
- When someone leaves, you know what to change. The manager shows exactly which shared logins they had access to.
- Turn on two-step verification on every email account. It's the account that resets every other one.
- Don't share passwords over WhatsApp or email. Share them through the manager instead.
Where to start tonight
Install a manager on your phone and your computer. Give it a long master password made of random words, and turn on two-step verification for it. Then change your email password first, because email resets everything else.
After that, let the manager swap out the old password every time you log in somewhere. One evening gets the important accounts done, and the rest sorts itself out over the next couple of months.
Sources: Verizon DBIR 2026, summarised by Descope (Jul 2026) · NCSC: three random words · NCSC: a separate password for your email · NCSC: managing your passwords
