Guides/Passwords after a breach
Should you change passwords after a breach?
Breach emails and “password reset required” banners are noisy. The useful question is narrower: was this account’s secret exposed, and did you reuse that secret anywhere else?
Change promptly when
- The site confirms passwords (not only emails) were stolen, or forces a reset.
- You reused that password on email, banking, or work SSO —why uniqueness matters.
- You see new login alerts you did not cause.
Priority order
- Email inbox — resets for everything else flow through it.
- The breached site — new unique password; enable 2FA if available.
- Any reuse twins — every other site that shared the old string.
- Vault master passphrase only if you typed it into the breached service (unusual — still review).
What “good” looks like after
- Long unique replacement — preferably from a manager —length guidance·managers.
- Local strength check only —safe checks.
- Do not recycle the old password with a year suffix.
When a change may wait
If a leak is email-only marketing lists and the vendor says passwords were hashed/salted with no evidence of cracking, still watch for phishing. Prefer official reset links you navigate to yourself, not links inside urgent mail.