A password does not need to be guessed twice if it has already been learned once.
Think of six accounts as rooms rather than as a list of websites. Some rooms use the same key, some share a recovery route, and some are already open through a remembered session. These relationships matter when something goes wrong. Looking only at the strength of one password can hide the connections that carry trouble into the next account.
Unique passwords remove a link that need not exist.
Draw the relationships without writing any secrets
Our local exercise names six fictional accounts: mail, shop, forum, photos, travel and bank. We assign labels A, B and C to their password groups without creating any actual passwords. Mail, shop and forum share A; photos and travel share B; bank alone uses C. A group label is enough to study reuse without collecting sensitive material.
Starting from mail, the graph contains two other accounts with the same password label. Starting from photos, it contains one; starting from bank, none. These counts describe additional reuse relationships, not successful intrusions. A real service may have another factor, risk checks or a different username. None of those systems is exercised by our drawing.
Why a good password can still be the wrong shared key
An independently generated password can resist guessing and still become known through an unrelated service problem or a convincing request for it. Once the exact value is known, its mathematical search space no longer protects other accounts using that value. Reuse converts one piece of disclosed information into something relevant in several places.
A tiny alteration between services is not a reliable way to separate them. Changing a suffix or replacing a familiar letter preserves a relationship that another person may infer. A password manager can handle fully different values while you remember fewer things. Its own access and recovery deserve careful protection because it becomes important infrastructure for your accounts.
The inbox is a different kind of connection
Unique passwords do not make every account independent. A main email inbox may receive reset links for several other services. If that inbox is unavailable or compromised, the recovery paths remain connected even when the passwords are unrelated. This is why the email account often deserves attention early rather than being treated as just another low-stakes login.
Consider where recovery messages go, whether the address still works, and whether an old phone number remains attached. You can review those settings through each genuine service without putting the values into a public spreadsheet. For a personal map, service names and dependency arrows are usually enough. Keep actual recovery secrets in an appropriate protected location.
Change the vulnerable connections in a sensible order
If there is no known incident, begin with essential accounts and any known reuse. Replace shared values with unique generated passwords, enable suitable stronger sign-in protection and verify recovery options. This is more useful than periodically rotating one predictable shared password into another. Follow the service’s instructions if it reports a particular exposure or requires a reset.
After a suspected compromise, use an independently reached official app or address. Change the affected password and reused versions elsewhere, examine recovery settings, and review or revoke unfamiliar sessions where the service supports it. A password change does not universally terminate every session. If you cannot regain control, use the service’s official recovery process rather than negotiating with an unexpected message.
Make the map smaller, not more alarming
In the model, assigning a different label to each of the six accounts removes every password-reuse link. That is a useful structural result, but it is not a promise of six safe accounts. Devices, software updates, fraudulent requests and recovery arrangements still matter. The point is to remove an avoidable common dependency, not to claim that one technique solves everything.
You do not need to finish an entire account inventory in one evening. Start with an inbox, a financial account or another service whose loss would interrupt daily life, then work outward. Save the new credentials before signing out, and check that they work through the genuine service. A careful sequence is better than a rushed collection of half-completed resets.
Further reading
CISA: Use strong passwords ↗NIST: Digital Identity Guidelines, Authentication and Authenticator Management ↗Original documentation and useful background.