Why Password Audits Matter

Data breaches are not rare events — they are continuous. Billions of username and password combinations from thousands of breaches are freely available on the dark web. Attackers use these in credential stuffing attacks: automatically testing leaked credentials against popular services. If you use the same password on multiple sites, one breach exposes all of them.

Password reuse is the single biggest password security problem for most people. A 2023 study by Google found that 65% of people admit to reusing passwords across multiple accounts. The consequences can be severe: email account compromise leads to password resets on every other account; social media takeovers damage reputations; financial account breaches cause direct monetary loss.

An audit takes an afternoon but provides protection for years.

What You Are Looking For

A thorough password audit identifies four categories of problematic credentials:

  • Breached passwords: Passwords that have appeared in known data breaches — these should be changed immediately regardless of other factors.
  • Weak passwords: Short, simple, or pattern-based passwords that could be cracked by brute force or dictionary attacks.
  • Reused passwords: The same password used on multiple accounts — compromise of one exposes all.
  • Old passwords: Passwords that have not been changed in years, which may predate your awareness of security best practices.

Step 1: Take Inventory of Your Accounts

You cannot audit what you cannot find. Start by creating a complete list of your online accounts. Sources to check:

  • Your email inbox — search for "welcome", "verify your email", "confirm your account"
  • Your browser's saved passwords (Chrome: chrome://settings/passwords, Firefox: about:logins)
  • Any existing password manager
  • App stores — look at what apps you have installed
  • Your email contacts and calendar — look for services you have connected

You will likely find 50–200+ accounts. Prioritise: financial accounts, email, social media, and any account that stores sensitive data or payment information.

Step 2: Check for Breached Credentials

The Have I Been Pwned service (created by security researcher Troy Hunt) aggregates data from known breaches. Enter your email address to see if it has appeared in any breach. The service is free and does not expose your actual password.

For individual passwords, HIBP also provides a Pwned Passwords API. It uses a k-anonymity model: you send the first 5 characters of your password's SHA-1 hash, and the API returns all hashes starting with those characters. Your full password is never sent to the server. You can use ToolMasta's hash generator to calculate your SHA-1 hash for this check.

Priority: If any password appears in a breach, change it immediately — on that service and on every other service where you have used the same or similar password.

Step 3: Assess Password Strength

For each password in your inventory, assess its strength based on:

  • Length: Fewer than 12 characters is weak. 16+ is recommended for important accounts.
  • Character variety: Lowercase only is weak. Mixed case, numbers, and symbols increase strength.
  • Predictability: Dictionary words, names, dates, and common substitutions (@ for a, 3 for e) are all weak regardless of length.
  • Patterns: Keyboard walks (qwerty, 12345), repeated characters, and sequential numbers are weak.

The strong password guide covers these criteria in detail, and you can read about the mathematics of password strength in our password entropy guide.

Step 4: Find Reused Passwords

If you are using a password manager, it will usually have a built-in audit tool that flags reused passwords. In Chrome, the Safety Check (Settings > Privacy and security > Safety check) identifies reused and compromised passwords.

If you are auditing manually, group your accounts by password. Any group with more than one account represents a reuse risk. Even if a password is strong in isolation, using it on multiple sites means a breach at any one of them compromises all of them.

Step 5: Fix Weak and Reused Passwords

Start with your highest-priority accounts: email, banking, and any account with payment information. Work through weak and reused passwords systematically. For each one:

  1. Generate a new, unique password — at least 16 characters, randomly generated.
  2. Update the password on the service.
  3. Record the new password in your password manager immediately.
  4. Confirm you can log in with the new password before closing the session.

Use ToolMasta's free password generator to create cryptographically random passwords of any length and character configuration. It runs entirely in your browser — passwords are never sent to any server.

Step 6: Move to a Password Manager

A password manager is not optional for maintaining good password hygiene — it is the only realistic way to use a unique, strong password for every account without memorising them all. Options include Bitwarden (open-source, free), 1Password, and KeePass (local-only, free).

Key features to look for:

  • Zero-knowledge encryption — the provider cannot read your vault
  • Open-source or independently audited
  • Browser extension for auto-fill
  • Mobile app
  • Breach monitoring / built-in audit tool

Step 7: Enable Two-Factor Authentication

Two-factor authentication (2FA) adds a second verification step — typically a time-based one-time password (TOTP) from an authenticator app — that prevents account access even if your password is known. Enable 2FA on every account that offers it, starting with email, banking, and social media.

Prefer authenticator apps (Google Authenticator, Authy, or a hardware key like YubiKey) over SMS-based 2FA, which is vulnerable to SIM-swapping attacks. Most reputable services now support TOTP-based 2FA.