We hear a version of this on support calls constantly: "I have one good password, and I just use it everywhere." We understand the appeal. It's also the single habit most likely to cost you an account.
Reuse Is the Real Problem
The threat isn't someone sitting at a keyboard guessing your password. It's that companies get breached, and when one does, the stolen email-and-password pairs get tried automatically against every other service—bank, email, utilities, shopping. If the same password opens all of them, one careless website hands over your whole life.
Complexity doesn't save you here. A long, clever password you've reused is still one password. Once it leaks, its cleverness is irrelevant.
What a Manager Actually Solves
A password manager keeps every login in an encrypted vault behind one strong password you memorize. It generates a different random password for each site, fills it in for you, and remembers which one goes where—because you no longer have to.
The quiet second benefit is phishing resistance. A manager fills in credentials based on the real web address, so a lookalike login page gets nothing. Your memory, on a tired evening, is less picky than software is.
The usual objection is putting all the eggs in one basket. It's a fair instinct, but the alternative isn't a safer basket—it's the same egg in fifty baskets, any one of which can be dropped by a stranger. A reputable manager encrypts the vault so the provider can't read it either.
Getting Started
You don't have to migrate two hundred accounts on a Saturday. Do this instead:
- Pick a manager. The one built into your browser or phone is far better than nothing; the standalone ones work across all your devices.
- Set one strong master password. Three or four unrelated words, long, written down and stored somewhere physically safe until you know it cold.
- Turn on the manager's second factor if it offers one. (Multi-factor sign-in and passkeys are worth their own posts—we'll get to both.)
- Change passwords opportunistically. Every time you log into something, let the manager generate a new one. Do your email and your bank first.
The takeaway: your email account is the master key to everything else, because that's where password resets land. Give it a unique password today and let the rest catch up over the next few months.