A password manager is not optional

Every time someone tells me they remember all their passwords, I know there is a problem. It usually means the same password, or a small variation of it, is reused across dozens of sites.

The problem does not start with you

It starts when one of those sites gets breached. Once your password is out there, someone will try it against every other service they can think of. It is called credential stuffing, and it is why most personal account breaches do not start with anything clever. They start with reused passwords.

What it looks like from the other side

The attacker is not sitting there guessing. They take a file of millions of email and password pairs from an older breach and run it automatically against every service they know. In practice it looks roughly like this:

# every line is email:password, straight out of an older breach
while IFS=: read -r email password; do
  curl -s -X POST https://example.com/login \
    -d "email=$email&password=$password"
done < leaked-credentials.txt

That code is not sophisticated, and it does not need to be. It works because the same password shows up in two places.

What to do instead

A password manager solves this without asking you to remember anything. A long random password per service, and one strong password that unlocks the rest. Add two factor authentication wherever you can, and you have a reasonable baseline without spending much thought on it.

Why it is worth the trouble

This is not expert advice trying to impress you. It is the simplest action I know of with the highest return.