How to Audit and Update Your Old Passwords

Most people have never done a full password audit. Passwords accumulate over years — some created when "password1" felt clever, some reused across a dozen sites without a second thought. A password audit is the process of systematically reviewing every account you have and replacing the weak links before someone else finds them for you.

Step 1: Make a complete list of your accounts

You can't audit what you haven't inventoried. Start by listing every account you can think of: email, banking, social media, shopping sites, work tools, streaming services, and anything else you've signed up for. If you use a browser's saved-password feature, export that list as a starting point — it's often more complete than your memory.

Step 2: Identify your weak points

Flag any password that falls into one of these categories:

• Reused passwords — the same password used on more than one site. This is the single biggest risk factor, because a breach on one site exposes every other account using it.
• Short passwords — anything under 12 characters, especially on important accounts.
• Personal-information passwords — names, birthdates, pet names, or anything findable on your social media.
• Old passwords — anything you haven't changed in over two years, particularly on high-value accounts.
• Passwords involved in known breaches — check using a breach-checking tool like Have I Been Pwned.

Step 3: Prioritize which accounts to fix first

You don't need to change every password today — prioritize by impact. Fix these first:

1. Email accounts — the master key to resetting everything else.
2. Banking and financial accounts — direct financial risk. See our banking password length guide for specifics.
3. Password manager master password — if this is weak, everything behind it is at risk.
4. Any account reused across multiple sites — these are actively increasing your exposure right now.
5. Work accounts — a compromise here can affect your employer, not just you.

Lower-priority accounts — old forum logins, one-time signup sites, accounts you no longer use — can be deleted entirely if you don't need them, which removes the risk altogether rather than just reducing it.

Step 4: Replace weak passwords systematically

For each flagged account, generate a new, unique, random password rather than tweaking the old one. Small modifications — adding a number, capitalizing a letter — don't meaningfully improve security, because attackers' cracking tools already account for these common patterns. Use our Password Generator to create a fresh, fully random replacement for each account, and store each one in a password manager as you go rather than trying to remember them.

Step 5: Set a maintenance schedule

A one-time audit is valuable, but password hygiene works best as an ongoing habit. Set a recurring reminder — every six months is reasonable — to review new accounts you've created since the last audit and check your email against breach databases. This turns a stressful one-time cleanup into a small, manageable routine.