Stop Reusing One Password Everywhere (A Plain Setup That Takes Ten Minutes)

I’ll be honest: for years my “system” was one strong-looking password with a different number tacked on per site. It felt clever until one leak made three logins awkward in the same week.

You don’t need a hobbyist security lab. You need unique passwords and a place to keep them that isn’t WhatsApp “Saved Messages.”

What actually fails in real life

People reuse passwords because memory is limited and forms are annoying. Generators feel random on purpose—that’s the point. The mistake is generating something good, then pasting it into a plain text file titled passwords.txt on the desktop.

Another failure mode: inventing passwords from pet names and anniversaries. Easy to type. Easy to guess when someone knows you.

A ten-minute setup I recommend to friends

1. Pick a reputable password manager (browser-built-in is better than a spreadsheet; dedicated apps are better if you’ll sync phones).
2. Create one long random master password. Write it on paper once, store the paper somewhere boring and private, then type it until your fingers learn it.
3. For each important site—email, bank, work—generate a fresh password with Password Generator.
4. Aim for length first (14+ characters beats a short “complex” string). Turn on uppercase, lowercase, numbers; add symbols if the site allows them.
5. Save it in the manager. Don’t email it to yourself.
6. Turn on 2FA for email and bank when offered.

That’s it. The generator does the ugly randomness. The manager does the memory. You do the discipline once per account when you next log in.

How I use the CalcoWorks generator

I open Password Generator, bump length up, generate, copy once, paste into the manager and the site, then close the tab. I don’t leave a trail of generated strings in screenshots.

If a site rejects symbols, I regenerate with a simpler character set rather than editing by hand—manual edits reintroduce patterns.

What I still won’t do

I won’t recycle the same “base” password across banks. I won’t store OTP screenshots in shared albums. And I won’t click my own ads or anyone else’s for “testing”—that’s a separate mess entirely.

If you’ve only got ten minutes today, fix email and banking first. Everything else can migrate the next time you hit “forgot password.”

Tool: Password Generator · related reading on our editorial page.