Password advice usually arrives as an all-or-nothing lifestyle change: audit everything, migrate to a manager, rotate every credential. Faced with that, most people do nothing - And "nothing" is how accounts actually get taken over. The Verizon Data Breach Investigations Report has said it for years: stolen and reused credentials, not exotic exploits, drive the majority of breaches.
So here's the opposite of an overhaul. Fifteen minutes, ordered by damage prevented per minute. Do it today; nothing on the list requires buying anything or learning new software. A timer genuinely helps - This checklist works because it's bounded.
Minutes 0–2: find out what's already leaked
Go to haveibeenpwned.com and enter your main email addresses. The service, run by security researcher Troy Hunt, indexes billions of breached accounts and tells you which breaches included your data and whether passwords were exposed.
Don't spiral if the list is long - Nearly everyone with an email address older than five years appears somewhere. You're here for one fact: which passwords are burned. Any password you used on a breached site is now in attacker wordlists and gets replayed automatically against other services (that's credential stuffing, and it's the top account-takeover mechanism on the internet). Note the burned ones; they're your rotation list for minute six.
Minutes 2–5: lock down your email first
Not your bank - Your email. Every "forgot password" link on every other account lands in your inbox, which makes email the recovery master key for your entire digital life. An attacker with your inbox can reset almost everything else you own; an attacker with your bank password but not your inbox usually can't even finish logging in.
Three fast checks:
- Is the password unique? Not used anywhere else, ever, including old jobs and forums. If it's shared or burned, change it now - Generate a long random one with a password generator and save it wherever you'll actually retrieve it.
- Is two-factor authentication on? If not, enable it before the timer runs out - An authenticator app beats SMS if you have the choice.
- Are the recovery options yours? Old phone numbers and defunct backup emails in your recovery settings are hijack routes. Prune them.
Minutes 5–8: the money accounts
Repeat the same three checks - Unique password, 2FA on, recovery current - For your primary bank, and anything holding a card or balance you'd miss: PayPal, Amazon, investment apps. Three minutes won't cover all of them; do the two with the most money attached and add the rest to the follow-up list. Depth beats breadth here - One properly locked bank account outranks ten half-checked logins.
Minutes 8–11: turn on 2FA where it counts
Two-factor authentication is the single highest-leverage setting in consumer security - Microsoft's long-standing figure is that it blocks over 99.9% of automated account-compromise attacks. If email and banking are covered from the earlier steps, spend these minutes on your main social account (impersonation gold) and your cloud storage (your documents and photos).
Use an authenticator app rather than SMS where offered. The six-digit codes are computed on your device from a shared secret and the clock - Our TOTP generator lets you see exactly how - So there's nothing for a SIM-swapper to intercept. Full setup walkthroughs live in our two-factor authentication guide. Save the backup codes each service offers; a lost phone without them is a support-ticket nightmare.
Minutes 11–14: triage the reused stragglers
You will not fix every reused password in three minutes, and you don't need to. Rotate the ones where reuse is most dangerous:
- Any account sharing a password with your email (that pairing undoes everything from minute two)
- Any account using a password that appeared in a breach
- Any password that's a formula - Pet + year,
Word123!- Because attackers guess patterns first
| Priority | Accounts | Deadline |
|---|---|---|
| Now (this session) | Email, primary bank | Minutes 2–8 |
| This week | Other financial, main social, cloud storage | 7 days |
| This month | Shopping, streaming, subscriptions | 30 days |
| Eventually / delete | Forums, one-off signups, dead accounts | Rolling |
Replacement passwords should be long and random - Length is the stat that matters most, as the crack-time tables in how long should a password be make brutally clear. Sixteen characters is a sound default.
Hygiene rule of thumb: every password should be doing exactly one job. The moment a password has two jobs, one breach fires both.
Minutes 14–15: pick your system going forward
The last minute is about stopping the decay. Passwords rot back into reuse when there's no default system for creating and storing new ones. Decide now, in one minute, which of these is yours:
- A password manager - The best answer for most people; our password manager guide compares the approaches if you're undecided.
- Your browser's built-in vault - Acceptable for lower-stakes logins if your devices themselves are locked and updated.
- A written notebook at home - Genuinely defensible for non-technical people, since burglars aren't running credential stuffing; just keep it away from your keyboard and never in a file on the computer. (One thing it can't defend against: malware that records your typing - But neither can a memorized password.)
Any of these beats the actual default, which is "reuse the password I can remember."
FAQ
Why does email outrank banking on this checklist?
Because email is the recovery path for everything else, banks included. A hijacked inbox lets an attacker trigger and receive password resets across your accounts, while banks additionally carry fraud monitoring and legal reimbursement processes. Secure the master key before the individual doors.
Do I really need to change passwords that haven't been breached?
Only the reused and the guessable ones. Modern guidance - NIST SP 800-63B included - Dropped routine forced rotation because it pushes people toward weak formula passwords; change on evidence instead. A long random password that's unique to one site can happily live for years. Reuse, not age, is the marker that matters.
Is writing passwords in a notebook actually okay?
For many people, yes - A paper notebook at home is immune to malware, breaches and phishing kits, and its one risk (physical theft) is rare and local. It scales poorly and doesn't autofill, which is why a manager is still the better tool. But paper beats reusing one memorized password everywhere, by a wide margin.
What about all the old accounts I found in the breach check?
Accounts you no longer use are pure liability: stored personal data and a reused password with zero benefit to you. Delete them when the service allows it - Justdeleteme-style directories list direct deletion links - And where deletion is impossible, overwrite the password with a long random throwaway and strip saved payment methods.
Fifteen minutes seems too short to matter. Does it?
The attacks that hit ordinary people are automated and lazy: replayed breach credentials against accounts without 2FA. The checklist targets exactly those failure modes on exactly the accounts with the highest blast radius. It's not complete security - It's the highest-value slice, which is the slice most people never get around to.