Tech-N-AI Talks logo Tech-N-AI Talks

Best How to Do Password Security After a Breach

A 90-minute password cleanup that protects you from the next data breach. Real tools, real prices, and a step-by-step checklist for US, UK and EU users.

Your Password Is Probably '123456', Here's How to Fix It Before the Next Breach — illustrative featured image
Danish researchers spent months combing through a leaked registry and found that roughly 8.8 million people had their data exposed. The single most common password in the dump? "123456." Not a clever typo, not a leetspeak variant, just six digits typed by millions of adults who should know better. If that stings, good. This guide walks you through a full password cleanup in about 90 minutes, spread across one evening or two coffee breaks. ## What you'll need - A [password manager](/blog/your-data-after-a-breach-a-practical-response-plan-for-normal-people). Bitwarden is free and works on every platform. 1Password costs $35.88/year for an individual. Both are fine. Pick one and move on. - A laptop or desktop browser (mobile works but is slower for bulk work). - Access to your email inbox, since that is the account that unlocks everything else. - Your phone, for two-factor codes. - 60 to 90 minutes. You can split this across two sessions if you want. - A notepad or blank document for temporary recovery codes. Shred or delete it when you are done. - Budget: $0 if you stick with Bitwarden's free tier. $36/year if you want 1Password's polish. ## Step-by-step ### Step 1. Install a password manager and create your vault Your first move is getting a single encrypted place to store everything. Download Bitwarden or 1Password from the official site. Do not install a browser extension from a search result, since typosquatted extensions are a real problem in 2026. Go directly to bitwarden.com or 1password.com. Create your master password. Make it a passphrase of four or five random words, not a "complex" string you will forget. "correct-horse-battery-staple" style works. Write it on paper and store it somewhere physically safe until you have memorized it. Tip: Your master password is the only one you truly need to remember. Everything else lives in the vault. ### Step 2. Secure your email account first Email is the master key to your digital life, so lock it down before anything else. Log into Gmail, Outlook, or whatever you use. Go to security settings. Turn on two-factor authentication using an authenticator app (Google Authenticator, Authy, or 1Password's built-in TOTP), not SMS if you can avoid it. Generate a new, unique password for the email account and save it in your vault. Change it now, not later. Watch out: If you use SMS-based 2FA, SIM-swap attacks can still get you. An authenticator app is meaningfully better. ### Step 3. Run a breach check on your existing accounts Find out which of your logins are already floating around on the dark web. Go to haveibeenpwned.com and enter your email addresses one at a time. The site is run by security researcher Troy Hunt and is the industry standard for this check. Note every service that shows up. Those are your priority targets for a password change. You can also check individual passwords at the same site's "Passwords" tab. If any of yours return a hit, change them today. ### Step 4. Change passwords on your top 10 accounts Start with the accounts that would hurt most if compromised. Rank your accounts by damage potential: banking, brokerage, primary email, [cloud storage](/blog/how-to-use-cloud-storage-on-iphone-android-ps5-and-whatsapp) (iCloud, Google Drive, Dropbox), work SSO, social media with payment methods attached, [Amazon](https://www.amazon.com/), then everything else. For each one, log in, navigate to the security or account settings page, and generate a new password using your manager's built-in generator. Set length to at least 16 characters with mixed case, numbers, and symbols. Let the manager autofill the new password. Do not type it yourself, since typos will lock you out. Tip: Most password managers have a "change password" flow that detects the form and offers to update the saved entry automatically. ### Step 5. Turn on two-factor authentication everywhere it exists Unique passwords stop credential stuffing. 2FA stops the attacker who already has your password. Go through each of your top 10 accounts and enable 2FA. Prefer authenticator apps or hardware keys (YubiKey, Google Titan) over SMS. For the very top tier (email, banking, password manager itself), consider a hardware security key. A YubiKey 5 NFC costs around $55 and is the single best $55 you can spend on [data breach protection](/blog/how-to-protect-yourself-after-a-data-breach-a-step-by-step-privacy-playbook). Watch out: Save your backup codes. Print them or store them in your vault as a secure note. If you lose your phone and have no backup codes, account recovery can take days. ### Step 6. Delete accounts you no longer use Every dormant account is a liability. The Danish breach did not need you to be an active user. Search your email inbox for "welcome" and "verify your email" to find old signups. Anything you have not touched in two years, delete it. Most services bury the delete option in account settings, often under "Privacy" or "Data." Under GDPR, EU and UK users have a legal right to deletion, and companies must comply within 30 days. ### Step 7. Audit saved passwords in your browser Chrome, Safari, and Edge all store passwords, and those stores are less protected than a dedicated vault. In Chrome, go to Settings, then Autofill and passwords, then Google [Password Manager](/blog/ai-security-crisis-how-hackers-breached-openai-and-what-you-can-do). Export the list, import it into your password manager, then delete the browser copies. In Safari, go to Settings, Passwords, and do the same. On iOS, it is under Settings, Passwords. Tip: If you have been syncing browser passwords across devices for years, this cleanup will feel tedious. Do it once and you never have to again. ### Step 8. Set up a recovery plan If you get locked out of your vault, you need a way back in. In 1Password, print the Emergency Kit and store it in a fireproof safe or a bank deposit box. In Bitwarden, set up an emergency access contact who can request vault access after a waiting period. Also configure account recovery options on your email provider. Add a backup phone number and a secondary email you actually control. ### Step 9. Schedule a quarterly review Password hygiene is not a one-time event. Set a calendar reminder for every three months. On that day, rerun the haveibeenpwned check and rotate any passwords for services that reported a new breach. This takes 15 minutes and catches the vast majority of new exposure before it becomes a problem. ## Common problems and fixes - **You cannot find the password change option.** Look under "Security," "Account," or "Privacy" in the settings menu. If it is truly missing, contact support. Some legacy services still require it. - **Your bank uses SMS 2FA only and won't let you switch.** This is common in the US. Use it, but make sure your mobile carrier account has a PIN or port-freeze enabled to block SIM swaps. - **Your password manager won't autofill on a specific site.** Click the extension icon manually and copy the password. Some sites block autofill for security theater reasons. - **You forgot your master password.** If you did not set up emergency access, you are out of luck. This is why Step 8 matters. Start over and this time write the master password down. - **A service requires a password under 16 characters.** Use the longest allowed, typically 12 to 14, and enable 2FA. That combination is still extremely strong. ## What to do next Once your vault is clean, tackle the accounts you skipped. That old forum login from 2014? It still matters if you reused the password elsewhere. Then get a hardware key. A YubiKey 5 NFC at around $55 covers USB-A, USB-C via adapter, and NFC for phones. It works on Google, Microsoft, Apple, and most banks that support FIDO2. This is the best how to do hardware-backed authentication for a normal person. Finally, get the people around you to do the same. Your security is only as good as the weakest account that can reach you. Walk a parent or partner through Steps 1 through 5 this weekend. ## FAQ **Is Bitwarden actually safe, or should I pay for 1Password?** Both use zero-knowledge encryption, meaning the company cannot read your vault. Bitwarden is open-source and audited. 1Password is more polished and has better sharing features. For a single user, Bitwarden free is genuinely enough. Pay for 1Password if you want the nicer interface or share vaults with family. **Do I really need to change passwords that have not been breached?** Yes, if they are reused across multiple sites or older than two years. Breach data gets sold and resold for years. A password that is clean today may not be next quarter. **What about passkeys? Are they replacing passwords?** Passkeys are rolling out fast on Google, Apple, Microsoft, and Amazon accounts. They are phishing-resistant and easier than passwords. Use them where offered, but keep your password manager, since most services still need a fallback password and not every site supports passkeys yet.

Frequently asked questions

Is Bitwarden actually safe, or should I pay for 1Password?

Both use zero-knowledge encryption, meaning the company cannot read your vault. Bitwarden is open-source and audited. 1Password is more polished and has better sharing features. For a single user, Bitwarden free is genuinely enough. Pay for 1Password if you want the nicer interface or share vaults with family.

Do I really need to change passwords that have not been breached?

Yes, if they are reused across multiple sites or older than two years. Breach data gets sold and resold for years. A password that is clean today may not be next quarter.

What about passkeys? Are they replacing passwords?

Passkeys are rolling out fast on Google, Apple, Microsoft, and Amazon accounts. They are phishing-resistant and easier than passwords. Use them where offered, but keep your password manager, since most services still need a fallback password and not every site supports passkeys yet.

Related articles