Guides/Unique passwords per site

Why unique passwords matter per site

A password that is strong on one site becomes a liability if you reuse it elsewhere. Attackers try leaked email + password pairs on banks, email, and shopping sites — a pattern called credential stuffing.

What “unique” really means

• Not a shared string: each important account gets its own secret, not a small family of variants (Site1!2026, Site2!2026).
• Length still matters: uniqueness without length is not enough — seepassword length.
• Managers scale uniqueness: random per-site passwords are realistic only with a vault —manager vs remembering.

Worked risk picture

1. Forum A leaks you@mail.com + RiverOak47!.
2. Bots try the same pair on your email and a store. If both used that password, both fall.
3. If only Forum A used it, the leak stays contained (still change that one, and enable 2FA where you can).

Practical habits

• Generate unique secrets in a password manager; memorize only the vault unlock (and device unlock).
• Passphrases are fine for a few high-touch logins if each phrase is unique —passphrase vs complex.
• Never paste live passwords into remote “strength” sites —check safely.

Common mistakes

• Keeping one “good” password for “unimportant” sites — those dumps still feed stuffing attacks.
• Emailing yourself the password list.
• Relying only on clever substitutions instead of uniqueness + length —checklist.

Try a local draft check

Password Strength Meterruns in your browser.