--- title: "A Strong Password Won't Protect You If You Use It Everywhere" url: https://resahost.net/en/guides/password-reuse-and-credential-stuffing/ canonical: https://resahost.net/en/guides/password-reuse-and-credential-stuffing/ language: en description: "A strong password won't protect you if you reuse it. How leaked credentials are used to break into accounts, and how a small business protects its own." author: "Olli Junes" author_url: https://resahost.net/en/team/olli-junes/ related: - "Security Rolling Out a Password Manager in a Small Business Read guide → — https://resahost.net/en/guides/password-manager-rollout-for-small-businesses/" - "Security Small Business Cybersecurity: A Practical Action Guide Read guide → — https://resahost.net/en/guides/small-business-cybersecurity-guide/" - "Security Cybersecurity Training for Small Business Teams Read guide → — https://resahost.net/en/guides/cybersecurity-training-for-small-businesses/" --- Security 5 min read · Updated 10/2026 # A Strong Password Won't Protect You If You Use It Everywhere A long, complex password slows down guessing. It does not help when the same password is used on a service that gets breached. Attackers try leaked credentials on other services automatically. The defence is a unique password for every service, plus two-factor authentication. Many businesses tell staff to create long passwords with capital letters, numbers and special characters. The advice is good, but it only protects against one kind of attack. Picture the same password used for an online shop, a newsletter sign-up and the company email account. Once the online shop leaks its user data, the length of that password no longer matters. ## Two different attacks In a brute force attack, software tries passwords with no prior knowledge. It works through character combinations and common passwords. A long, complex password makes guessing slow. This is the attack that strong-password advice works against. In credential stuffing, the attacker already has a real email address and a real password. They come from a data breach at some other service. The attacker tries the same pair on other services, counting on some users having reused the password. Nothing needs to be guessed. Cloudflare states the difference plainly in its [Learning Center article](https://www.cloudflare.com/learning/bots/what-is-credential-stuffing/): password strength does not protect against this attack if the password is shared across accounts. ## Why the attack pays off despite failing most of the time According to Cloudflare, many estimates put the success rate at about 0.1 per cent. Roughly one account in a thousand opens. But leaked credentials are traded and sold in lists of millions, sometimes billions, of username and password pairs. A list of one million pairs yields around a thousand compromised accounts. The same list can then be tried on service after service. Attackers don't do this by hand. Bots attempt logins simultaneously from different IP addresses and appear to come from different devices. That is why the usual protections don't stop them. A delay after a failed login, or a block on an IP address that keeps failing, is built to stop one attacker, not thousands of apparently separate users. Cloudflare notes that the only sign a service operator often sees is a rise in the overall number of login attempts. ## What this means for a small business In a small business, one account often opens a lot. Email is where other services' passwords get reset. Cloud storage holds contracts and payroll data. The website admin panel can change what every page says. Password reuse usually comes from everyday habit. With dozens of services to log in to, people come up with one good password and use it everywhere. Sometimes they change only the number at the end. That does not make it a new password, because a variation is just as easy to try as the original. Credentials also move around inside the company. A shared login gets pasted into a chat or a spreadsheet because no other way was agreed. When someone leaves, nobody knows for certain which passwords they knew. ## How to protect your accounts Cloudflare's advice to users is short: a unique password for every service. If every password is different, a leaked one opens nothing else. Cloudflare mentions a password manager as an easy way to achieve this. It also recommends turning on two-factor authentication whenever a service offers it. In a business, that comes down to four things: 1. A password manager creates a long, random password for every service. Nobody has to remember them. 2. Two-factor authentication is switched on at least for email, cloud storage, accounting and the website admin. An attacker who has only the password cannot get in. 3. Reused passwords are changed. Start with email, because that is where the others get reset. 4. Shared logins move into a shared vault. When an employee leaves, you can see which logins they had access to, and you change them. A business cannot control which passwords employees use on outside services. It can give them a tool that makes the right way easier than the wrong one. ## Checking for leaked passwords is not enough on its own Some services compare a new password against a list of known breached passwords before accepting it. Cloudflare says this helps but is not foolproof. The user may be reusing a password from a service that has not been breached yet. The same applies to password manager warnings. 1Password's Watchtower warns about weak, reused and breached passwords. It also tells you when two-factor authentication is missing. The warning tells you what to change. Someone still has to change it, so agree who does. ## If your customers log in to your service If you run an online shop, a customer portal or any other service with customer logins, the attack is aimed at you too. Your systems don't need to have been breached. The attacker tries credentials leaked elsewhere against your customers' accounts. Cloudflare lists two-factor authentication, a CAPTCHA at login and bot management as the operator's defences. Bot management limits login attempts and recognises IP addresses with a bad reputation. Cloudflare sells bot management itself, so its recommendation of the strongest defence is also a vendor's recommendation. Two-factor authentication is a good place to start whatever platform your service runs on. ## Getting started ResaHost sets up password management for businesses with 1Password Business. We create the account in the European region, add your users and help move your existing logins across. The steps are described in the guide [rolling out a password manager in a small business](https://resahost.net/en/guides/password-manager-rollout-for-small-businesses/). The service page is currently [in Finnish](https://resahost.net/palvelut/salasanahallinta/), so [contact us](https://resahost.net/en/contact/) for a quote. For the wider basics, read the [practical cybersecurity guide](https://resahost.net/en/guides/small-business-cybersecurity-guide/). ## Sources - Cloudflare: What is credential stuffing? [https://www.cloudflare.com/learning/bots/what-is-credential-stuffing/](https://www.cloudflare.com/learning/bots/what-is-credential-stuffing/) (read 19 October 2026) Password management, set up for you 1Password Business, rolled out and supported by ResaHost. Pricing by quote. Ask for a quote ## Frequently asked questions ## Is a long password enough? Not if the same password is used elsewhere. Length slows down guessing. Credential stuffing doesn't guess anything: it tries a password the attacker already has. ## What is credential stuffing? An attack in which usernames and passwords leaked in one service's data breach are tried on other services. It works when a user has reused the same password in more than one place. ## How do I know if my password has leaked? A password manager can warn you about passwords exposed in data breaches. In 1Password, Watchtower does this. If a password has leaked, change it on every service where you used it. ## Does two-factor authentication protect me if my password has already leaked? It stops a login where the attacker has only the password. You should still change the leaked password. ![Olli Junes: Founder and CEO of ResaHost](https://resahost.net/assets/team/ollijunes.webp) Author Olli Junes: Founder and CEO of ResaHost Founder and CEO · ResaHost, Finland @resacolli LinkedIn ## Read next Security ### Rolling Out a Password Manager in a Small Business Read guide → Security ### Small Business Cybersecurity: A Practical Action Guide Read guide → Security ### Cybersecurity Training for Small Business Teams Read guide →