🔍 How to Do a Password Audit: Find and Fix Weak Logins in 30 Minutes (2026)
On this page
The average person manages over 100 online accounts but uses only about seven unique passwords — based on NordPass's analysis of 2.5 billion breach records in their 2024 password study. Attackers know this. Credential stuffing — automatically testing leaked passwords across hundreds of sites — has become the dominant account-takeover method precisely because it exploits reuse rather than any technical flaw in the sites themselves.
A password audit is how you close that gap: a systematic pass through every login you own to find the weak links before someone else does. Done right, the first audit takes under 30 minutes, and a password manager can keep it running automatically afterward.
What Is a Password Audit?
A password audit is the process of reviewing every account you own to identify and fix three categories of risk: reused passwords shared across multiple sites, weak passwords that are short, common, or predictable, and exposed credentials that have already appeared in a known data breach. The outcome of a successful audit is every account holding a unique, randomly generated password that exists nowhere else on the internet.
Why Your Passwords Need Auditing Now
The case for auditing is not abstract. Three authoritative sources put the scale in concrete terms:
- Verizon's Data Breach Investigations Report has consistently found that compromised credentials are involved in roughly 80% of web application breaches — not software flaws, but stolen or reused passwords used by attackers to simply log in as you.
- A Google and Harris Poll survey found that 52% of people admit to reusing the same password across multiple accounts, and 13% use a single password for every account they own.
- NIST SP 800-63B now explicitly instructs organisations to compare user passwords against known breach databases — a formal acknowledgement that breach exposure is an ongoing, routine risk that must be checked proactively.
The attack that exploits all three vulnerabilities at once is credential stuffing: automated bots take username-and-password pairs from one breach and test them against hundreds of other services in bulk. The attack runs silently, and you will not know it succeeded until you are locked out or notified of unusual activity — often weeks after the compromise.
How to Audit Your Passwords in 5 Steps
Step 1: Build Your Account List
Search your primary email inbox for sign-up messages — terms like "welcome to", "confirm your email", and "your new account" reliably surface services you have forgotten you joined. Also check your browser's saved passwords and any existing password manager vault. For a first audit, a list of 30 to 50 accounts covering email, banking, social media, and any site holding a saved payment method is enough to identify the biggest risks. You are building the inventory so you know the full scope of what you are protecting.
Step 2: Find Reused Passwords
Reuse is the largest single risk and the easiest to detect automatically. In Chrome, navigate to chrome://password-manager/checkup and run the built-in password check. In Safari, go to Settings → Passwords → Security Recommendations. In Firefox, open about:logins and look for the warning flag icon. Any dedicated password manager's security dashboard flags reuse automatically without any manual steps. Every account sharing a password with another account is a high-priority target regardless of how strong that password looks in isolation.
Step 3: Check for Breach Exposure
Go to HaveIBeenPwned.com and enter each email address you use to log in to sites. The service checks your address against more than 13 billion breach records and tells you exactly which services have been compromised and what data was included. Any flagged service should be treated as if its password is already in attacker hands — credential databases circulate and get reused for years after the original incident. A good password manager runs this check continuously and alerts you to new breaches as they are publicly disclosed.
Step 4: Grade Password Strength
For any credential not caught by the first two steps, check its actual composition. An audit-passing password is at least 16 characters long, randomly generated rather than a recognisable word or phrase, unique to that single site, and absent from known leaked password lists. Passwords like "Summer2024!", "company@123", or any name-plus-number combination fail this test regardless of their length — they follow patterns that appear near the top of every credential list attackers try first. NIST's current guidance (SP 800-63B) treats length and uniqueness as the two strongest predictors of real-world password security, more than complexity rules like requiring symbols.
Step 5: Fix in Order of Risk
Do not attempt to fix everything in a single session. Work through accounts in this sequence so the most dangerous exposures are closed first:
- Primary email account. Email is the password-reset mechanism for almost every other service you own. Whoever controls your inbox can reset anything else with a few clicks.
- Financial accounts. Bank, investment, and payment apps — any account capable of moving money or authorising purchases.
- Reused or breach-exposed credentials. Every account flagged in steps 2 and 3, in any order.
- Work accounts. A compromised work login is not just your problem; it can expose colleagues and customer data.
- All remaining accounts. Work through these at a steady pace — a handful per day — until every account in your inventory is fixed.
For every account you fix, generate a new password using your manager's built-in generator or a trusted external generator — never invent one yourself. Store it in the manager immediately. The goal is a vault where every account has a password that exists in exactly one place: inside the encrypted vault.
How a Password Manager Automates the Whole Process
The manual steps above work well as a one-time reset, but a password manager converts the audit from a periodic project into continuous, automatic protection. It generates unique passwords on demand, stores them in encrypted form, monitors for breach exposure in the background, and flags any reuse or weak credential without requiring you to run a check manually.
NordPass includes a Password Health dashboard and a Data Breach Scanner that automatically flags reused, weak, and breach-exposed credentials across your entire vault — covering steps 2, 3, and 4 of this audit without any manual checking. It uses zero-knowledge, XChaCha20 encryption so your vault contents are never readable by NordPass or anyone intercepting your connection, syncs across every device you own, and stores passkeys alongside passwords so everything lives in one place as the web transitions away from passwords. Running a check takes under two minutes because the scanning happens continuously in the background: by the time you open the dashboard, the inventory is complete and only the fixes remain.
Password Audit Checklist
| What to check | How to run it | Priority if found |
|---|---|---|
| Reused passwords | Browser security check or password manager dashboard | High — fix immediately |
| Breach-exposed credentials | HaveIBeenPwned or manager's breach scanner | Critical — fix today |
| Weak passwords (short or predictable) | Password manager health score or strength check | High — fix within a week |
| Accounts without two-factor authentication | Review security settings on email, bank, and social accounts | Medium — enable after passwords are fixed |
| Old or unused accounts | Email search for forgotten sign-up confirmations | Low — delete the account if no longer needed |
Affiliate disclosure: Some links in this article are affiliate links. If you sign up through them we may earn a small commission at no extra cost to you. Our password generator is free to use and we only recommend tools we would use ourselves. See our full affiliate disclosure.
FAQs
How often should I audit my passwords?
Once a year is a reasonable minimum for a manual audit. The better long-term approach is a password manager that monitors continuously and alerts you whenever a new breach includes your credentials — turning the annual review into a brief check of new flags. At minimum, run an audit immediately whenever you hear of a large breach at a service you use, even if your specific account has not yet been confirmed as affected.
What is the fastest way to start a password audit right now?
Open your browser's built-in password checker. In Chrome: chrome://password-manager/checkup. In Safari: Settings → Passwords → Security Recommendations. In Firefox: about:logins and look for warning flags. Each takes under two minutes to surface the most obvious reused and breached passwords without any additional setup. For a comprehensive audit across all browsers and devices simultaneously, a password manager's health dashboard is faster because it centralises everything into one view.
Should I audit passwords for accounts I never use any more?
Yes, for two reasons. First, dormant accounts still hold personal data — name, address, phone number, payment history — that attackers can exploit directly or use to build phishing profiles. Second, old credentials are frequently reused on active accounts, meaning a breach on a forgotten site can expose current, live logins. The cleanest solution for genuinely unused accounts is to delete them outright rather than simply changing the password: less data retained means less ongoing exposure.
Can I do a meaningful password audit without a password manager?
Yes, though it requires more discipline to maintain over time. Use HaveIBeenPwned for breach exposure, your browser's built-in check for reuse, and a strong random password generator for replacements. The key limitation is continuity: browsers only check the passwords they have saved, and you must remember to re-audit manually on a schedule. A dedicated manager turns this from a periodic manual exercise into an automated background check that runs every day.
What single thing should I fix first in a password audit?
Your primary email account. Whoever controls your email inbox can use the "forgot password" link to reset access to almost every other account you own — it is the master key to your digital life. Give it a long, unique, randomly generated password stored nowhere else, and enable two-factor authentication on it before working on anything else in your audit. Securing email first means everything subsequent is substantially less urgent because the primary recovery mechanism is protected.
