Staying Safe Online · Passwords & Sign-ins · Lesson 2 of 5

One Account, One Password

Why one password for everything is risky, and how to check and fix it.

Why reusing a password is risky

Many people use the same password for every account. It feels easier. It is also one of the biggest risks online.

Here is why. Websites sometimes get broken into. A data breach is when criminals steal information from a company, such as email addresses and passwords. It happens to big and small companies, and it is not your fault.

After a breach, criminals take the stolen email and password and try them on other sites. They use programs that try them on email, banks, shopping sites and social media, all at once.

Picture it like this:

• You use the same password for a pizza site and your email.
• The pizza site has a breach.
• Criminals now try that password on your email, and it works.
• From your email, they can reset the passwords on your other accounts.

One weak spot opened every door.

Now picture each account with its own password. The pizza site leaks, and the criminals get one password that only works on the pizza site. Everything else stays locked.

That is the whole idea of this module. Every account gets its own password. Your email and your bank matter most, so start with those.

Check for breaches and fix it

You can find out if your email address was part of a known breach. A free website called Have I Been Pwned keeps track of them. Its address is haveibeenpwned.com. "Pwned" is internet slang for "beaten" or "taken over".

1. Open your browser and type haveibeenpwned.com in the address bar.
2. Type your email address in the box and click the button to check.
3. Read the result. It lists the sites where your email showed up in a breach, if any.

If your email is on the list, don't panic. It is very common. It means you should change the password you used on those sites, and anywhere else you used the same one.

To change a password:

1. Sign in to the account on its real website or app.
2. Look for Settings, Account or Security.
3. Choose Change password. Type the old one, then a new one.
4. Make the new one long and different from all your others.

Start with your email account, since it can reset everything else. Then do your bank and shopping sites.

Go to the site yourself. Never change a password from a link in a surprise message. It might be a trick.