Security · 8 min read · 2026-09-01
Every year, billions of credentials leak onto the internet from breached services. Attackers do not "hack" individual accounts one by one - they take leaked email and password pairs and try them automatically on hundreds of other sites. This is called credential stuffing, and it works because people reuse passwords. The single most effective defence is also the simplest: a different password for every account, generated randomly, stored in a password manager.
Password cracking is a numbers game. An 8-character password with upper case, lower case, digits and symbols has around 6 quadrillion combinations - which modern GPU rigs can burn through in hours. A 20-character random password has more combinations than seconds elapsed since the Big Bang, even using only lower case letters. Complexity rules (must contain a symbol!) matter far less than sheer length, because attackers do not guess by hand - they try entire keyspaces.
Breach databases are searchable. If your password appears in one, assume criminals have tried it against your email on every major service already. The right response is to change it everywhere it was used - not just the breached site - and to enable two-factor authentication where available. Password checkers that reference breach corpora (like Zoven's, which consults the Pwned Passwords dataset) can tell you whether a specific password has been seen in public leaks without ever sending the password itself to a third party unhashed.
You do not need a different strong password for every site because you might forget them. You need them because one of those sites WILL leak.