Never reusing a password
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
The most common way an exchange account falls is a password reused from a site that leaked. Give every service its own long, unique password and let a password manager hold them. Seed phrases and private keys, however, do not go in there.
Key points
- Leaked email-and-password pairs get replayed automatically against other services
- You cannot memorise enough of them — let a manager hold them and memorise one
- The master password must be long and used nowhere else
- A seed phrase or private key is not a password: keep it offline, not in the manager
Definition
Generating and storing a unique, strong password for every service so that one breach cannot cascade — typically with a dedicated password manager.
Attackers are not guessing your password. They buy a list of email-and-password pairs leaked from some other service and replay it automatically against exchange logins. This technique — credential stuffing — simply does not work against unique passwords. Reuse the password from a shopping site on your exchange, and that shopping site's security team is now guarding your assets.
The workable answer is to let software generate a long random password per service and remember it for you. Password managers are built into browsers and phones, so you can start at no extra cost. Broadly they come in three shapes: local-only, encrypted-and-cloud-synced, and open-source self-hosted. Whichever you pick, you memorise only the master password — and use it nowhere else.
Protect the manager itself with two-factor authentication. And before you entrust anything valuable to it, work out what happens if you forget the master password or your device dies. Leave that vague and you will eventually lock yourself out without any attacker involved.
One boundary matters. Exchange and email passwords belong in the manager; a wallet's seed phrase or private key does not. Unlike a password, these cannot be reissued, and if the manager account is ever breached the funds are immediately movable. A seed phrase belongs on something physical and offline — paper, or a stamped metal plate — never in a synced vault.
Watch out for
- · Do not put a seed phrase or private key into a password manager or a cloud note
- · Fake extensions and fake apps impersonate password managers — install only from the official source
- · Work out the recovery path for a lost master password before you depend on the manager
Frequently asked questions
Is the browser's built-in password saving good enough?
For the purpose of ending reuse, it is clearly better than nothing. But because a stolen browser profile exposes the lot at once, pair it with a locked device and two-factor authentication on the browser account.