Use a unique, strong password and a password manager for every account

A unique, strong password for every single account, generated and stored in a password manager rather than reused or pattern-based, eliminates the single most common way accounts actually get compromised, credential reuse from an unrelated breach elsewhere.

The overwhelming majority of account compromises come from reused passwords leaked in an unrelated breach, not from someone directly guessing or cracking a strong unique password, this single practice closes that entire attack vector.

How to do it

1. 1
   Set up a real password manager

   A dedicated tool designed for this, not a browser-saved password list or a spreadsheet.
2. 2
   Audit your current passwords for reuse

   Most password managers can identify reused or weak passwords across your accounts directly.
3. 3
   Generate a unique, strong password for every account

   Let the password manager generate genuinely random, unique passwords rather than variations on a theme.
4. 4
   Prioritize your most consequential accounts first

   Email, hosting, domain registrar, and financial accounts before less critical ones.