How to Audit Your Passwords Before You Get Hacked

Every client who gets breached tells me the same thing afterward: "I thought my passwords were fine." They weren't. Nobody's are, until they actually check. A password audit isn't optional hygiene you get to when you have free time — it's the single highest-leverage security task you can do this weekend, and it takes about two hours if you follow a system instead of guessing. Here's the system.

Why Most Password Audits Fail Before They Start

People try to audit their passwords from memory. They open a mental list of "the important accounts," check those, feel good, and stop. That's not an audit — that's a vibe check. A real audit starts from a complete inventory, not a guess, because the accounts you forgot about are exactly the ones still running a password you reused in 2019 and exactly the ones an attacker will find first. You cannot secure what you haven't listed.

The other failure mode: people check if a password is "strong" and call it done. Strength doesn't matter if that same strong password is sitting in three other breached databases because you reused it. Reuse is the actual killer, not weak character count. Keep that distinction in your head through the rest of this.

Step 1: Inventory Every Account

Use a spreadsheet. Not memory, not a mental list, not "I'll remember the important ones." Memory is exactly how accounts get skipped, and skipped accounts are how attackers get in through the side door while you're busy locking the front one.

Open a blank spreadsheet with these columns: Account/Site, Email Used, Current Password (yes/no reused), Risk Tier, 2FA Enabled (yes/no), Last Changed. Then go pull the full list from your browser's saved password manager — Chrome, Firefox, Safari, whatever you actually use — because that's the closest thing to ground truth you have. Add anything not saved there that you know exists: banking apps, work logins, old forums, that one crypto exchange you signed up for in 2021 and forgot about.

Don't skip the dead accounts. An account you don't use anymore still has your email and possibly your payment info sitting in someone's database, and if that database gets breached, your reused password is the bridge to everything else. Old and inactive doesn't mean irrelevant to your risk.

Step 2: Check Every Email Against HIBP

Take every email address from your inventory — yes, all of them, including old ones — and run each through Have I Been Pwned. This tells you which breaches your email has already appeared in and, more usefully, which passwords were exposed alongside it in past dumps.

ALLIOPSEC runs a free scanner at the bottom of this post for exactly this step — same underlying breach data, faster workflow if you're checking multiple addresses at once. Either way, the point is the same: you need to know which of your credentials are already public before you decide what to rotate first.

Log every hit in your spreadsheet's risk tier column. An email that's shown up in five breaches with a plaintext password exposed is a five-alarm fire. An email that's clean is still worth checking again in six months, because breach databases update constantly and today's clean result isn't permanent.

Step 3: Identify Reused Passwords

This is where most people get uncomfortable, because this is where you find out how bad it actually is. Export your saved passwords from your browser and sort them by the password value itself — not the site. Any password that appears more than once in that sorted list is a reused password, full stop, and every account sharing it is only as secure as the weakest site it's used on.

That last line is the one that matters — it prints every password value that shows up more than once, with a count. If you see any number higher than 1, that password is reused and needs to be treated as compromised across every account using it, whether or not it's shown up in a breach yet. Reuse is the vulnerability. The breach is just when it becomes someone else's problem too.

Step 4: Classify by Risk Tier

Not every account deserves the same urgency. Sort your spreadsheet into four tiers and work top-down:

• Financial — banking, investment platforms, crypto exchanges, payment apps. Anything with direct access to your money. Fix these first, no exceptions.
• Email — your primary and recovery email addresses. These are the master keys to every password reset flow you have, which makes them a higher priority than almost anything else on this list.
• Social — platforms tied to your identity and reputation. Real damage potential, usually lower financial risk, but high impact if hijacked and used to scam your contacts.
• Misc — forums, newsletters, one-off signups. Lowest priority, but still get to them — a misc account breach is still a data point an attacker can use to build a profile on you.

Step 5: Rebuild With a Password Manager Stack

You will not remember 80 unique, strong passwords, and you shouldn't try. Pick one password manager and commit to it fully — half-measures where you use it for some accounts and memory for others is how gaps reopen.

Bitwarden (free tier) covers unlimited passwords across unlimited devices with solid encryption and open-source auditability — genuinely enough for most people, no upsell required. 1Password (paid, roughly $3/month) adds a more polished UI, travel mode that hides vaults at borders, and better team-sharing features if you need to share credentials with family or employees. Either one beats reusing passwords by an order of magnitude. Pick based on budget and move on — don't let choosing the tool become another excuse to delay using it.

Go through your risk tiers in order and generate a new, unique, manager-stored password for every single reused or breached credential you flagged. Financial first. No exceptions, no "I'll get to it later" on the accounts holding your money.

Step 6: Enable Hardware 2FA Where It Matters Most

Passwords alone — even good ones — are one phishing email away from being handed over voluntarily. Two-factor authentication is your backstop, and not all 2FA is equal. SMS-based 2FA is better than nothing but vulnerable to SIM-swapping. App-based TOTP (Authy, Google Authenticator) is stronger. A hardware key like a YubiKey is the strongest option available to a normal person, because it can't be phished remotely — the attacker needs the physical device in their hand.

You don't need hardware 2FA on every account. Reserve it for your email, your password manager itself, and your financial accounts — the tier-one stuff from Step 4. Use app-based TOTP for everything else. That combination gets you real protection without turning every login into a chore.

None of this is complicated. It's just tedious, and tedious is exactly why most people skip it — right up until they can't. Block off two hours, run the six steps in order, and you'll be in a genuinely different risk category than you were this morning.