Password Managers & Passkeys

Why Passwords Are Broken (And What We Do About It)

The average person has over 100 online accounts. If you're honest with yourself, you probably reuse the same handful of passwords across many of them — maybe with minor variations like adding a ! or swapping an o for a 0. You're not alone. Over 60% of people reuse passwords.

Here's why that's dangerous: when one service gets breached, every account sharing that password is compromised.

This isn't hypothetical. Credential stuffing attacks — where attackers take leaked username/password pairs and try them on hundreds of other services — are one of the most common attack vectors today. If your email and password from a 2019 data breach still work on your bank account, you're one automated script away from a very bad day.

What Makes a Password "Strong"?

Password strength comes from unpredictability (entropy), not complexity rules. Let's compare:

• P@ssw0rd! — Looks complex, but is one of the most commonly used passwords. Cracks in seconds.
• correct horse battery staple — Four random words. Much harder to crack, much easier to remember.
• k8$mQ2!vLp9#xR4& — Truly random, extremely strong. Impossible to remember without help.

The key insight: you shouldn't be remembering passwords at all. That's what password managers are for.

Password Reuse: The Real Threat

Let's walk through a realistic attack:

1. A food delivery app gets breached. Your email and password are in the leaked database.
2. An attacker buys the leaked data on a dark web marketplace for a few dollars.
3. Automated tools try your credentials on Gmail, Amazon, Netflix, your bank, and hundreds of other sites.
4. Your email uses the same password. The attacker is now in your inbox.
5. From your inbox, they reset passwords to your bank, social media, and cloud storage.
6. One reused password has compromised your entire digital life.

This cascade happens because email is the master key. If an attacker controls your email, they can reset the password to almost any other account.

The Solution: Unique Passwords Everywhere

The only way to stop credential stuffing is to use a unique, random password for every single account. No human can remember 100+ unique random passwords. That's not a willpower failure — it's a math problem. The solution is a password manager.

The Master Password: Your One Password to Rule Them All

With a password manager, you only need to remember one strong master password. This password:

• Should be at least 16 characters
• Should be a random passphrase (4-5 unrelated words)
• Should not be used anywhere else, ever
• Should be something you can type from memory

Example: telescope-margin-avocado-bicycle-thunder

This is the one password you actually memorize. Everything else lives in the vault.

What About Security Questions?

Security questions ("What's your mother's maiden name?") are often weaker than passwords because the answers are guessable or findable on social media. Treat security questions as additional password fields: generate random answers with your password manager and store them in the notes field of the account entry.

Question	Real Answer	What You Store
Mother's maiden name	Smith	kR7$mPx2Qv
First pet's name	Buddy	nL4&vBw8Ht
City you were born	Denver	jF9#cXm3Ry

You'll never remember these — and that's the point. They're in your vault, and no one can guess them from your Facebook profile.