Password Reuse.

The practice of using the same password across multiple accounts or services, which lets a single breach compromise many of them. It belongs to the Identity & Access category of cybersecurity.

The practice of using the same password across multiple accounts or services, which lets a single breach compromise many of them.

Password reuse occurs when a user picks the same or a trivially modified password for personal email, work, banking, and dozens of other services. If any one of those services is breached and the password is cracked or leaked, attackers can replay the credential against other sites in a credential-stuffing attack and take over additional accounts. Studies and incident reports consistently show that reuse is the dominant amplifier of password-based breaches. Defences include unique passwords per site generated by a password manager, mandatory checks against known-breached password lists, multifactor authentication, and gradual migration to passwordless options such as passkeys that eliminate shared secrets entirely.

Defences for Password Reuse typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Reused password, Shared password across accounts.