Staying safe
A different password for each account
What you will be able to do In 7 minutes, you'll know how to organize your passwords account by account, without memorizing too much.
Almost everyone has the same habit: one password that works, and you use it everywhere. It's understandable, and it's the one real weak spot. When a website has its customer list stolen, thieves get hold of email-and-password pairs, then machines try those pairs on hundreds of other websites. This technique has a name: credential stuffing. One reused password, and a leak at a seed shop opens your email. We're going to look at how to get organized without memorizing anything by heart, on a screen we designed. Nothing here is real, so nothing can happen to you.
Simulated screen
I practice
This screen was drawn by us. Nothing is sent, nothing is installed, and no real brand is shown.
The situationYou count your online accounts on your fingers, and you get to fifteen.
The interactive exercise needs JavaScript. The written step by step, just below, says exactly the same thing.
The written step by step
The same steps, in words, to read or print. This sheet works even without the exercise.
The domino effect
Your turn A shop has its customer list stolen. Touch what happens next.
The same password everywhere turns a leak at a seed shop into the key to all your accounts: that's credential stuffing.
The move that closes the door
Your turn You've understood what's coming. Touch what you do now.
We change this password everywhere it was used, starting with email, and set a different one for each place.
The account that opens the others
Your turn Four of your accounts. Touch the one that deserves the strongest password.
Email is the pivot account: it's how you reset all the others. That's why it gets the strongest password.
Remembering without memorizing
Your turn Fifteen different passwords to keep track of. Touch the method that holds up.
Two honest solutions: a paper notebook kept at home, or a password vault, a program that keeps them all behind a single one.
The key to the vault
Your turn The vault keeps everything behind one password. Touch how you choose that one.
The vault's password is the strongest of all, and it's written in the paper notebook kept at home, because losing it locks the vault.
Where to start tonight
Your turn Fifteen accounts to redo. Touch how you get started.
We start with three accounts: email, the bank, and the one used to pay. The others get redone over the following weeks.
The sheet to keep
- The same password everywhere turns a leak at any random website into the key to all your accounts: that's credential stuffing.
- Stolen email-and-password pairs are automatically retried on hundreds of websites, for years.
- Email is the pivot account: it's what resets all the others. It therefore gets the strongest password.
- Two honest solutions for staying organized: a paper notebook kept at home, or a password vault, also called a manager.
- The password that opens the vault is the longest of all, and it lives somewhere other than inside the vault.
- A visible trick, like adding the site's name at the end, is guessed the moment a single one of these passwords leaks.
- You start with three accounts, not fifteen: email, the bank, and the one used to pay.
The reflexes in this skill
One account, one door: every door has its own key
A password reused everywhere turns one leak into a break in everywhere. A long passphrase for each important account, written down somewhere safe, holds up better than a complicated password used again and again.
I make a copy of what matters
Photos, documents, contacts: anything that exists in only one place can disappear along with the device. A copy somewhere else turns a breakdown into a minor inconvenience.
No one serious ever rushes me
No threats, no countdown, no secret to keep. And asking for help is a reflex, not a failure: saying it out loud to someone makes most scams fall apart.
Two questions to check
Nothing is graded, and nothing is saved anywhere except in your own browser.
A website where you have an account announces that its customer list has been stolen, passwords included. You used that password elsewhere too. What do you do?
See the answer
I change this password everywhere it was used, starting with my email
It's the password that's stolen, not just the website. Machines try the email-and-password pair on hundreds of other services: it needs to be replaced everywhere, starting with email, which resets the others.
Among your accounts, which one deserves the strongest password of all?
See the answer
The email account, which is used to recover all the others
When a password is forgotten, the service sends a reset link by email. Whoever gets into your email can therefore take over almost all your other accounts, which makes it the pivot account to protect first.
I've done it
Check this box once you can do this skill on your own.
Your progress stays in your own browser.