1. Decide whether this is an active incident
Have you entered a password on a suspicious page, received a verified security warning or found account activity you do not recognise? Open the provider through its known official route and secure the account promptly. Do the same for other accounts using that password. Check their sessions and recovery information too. For a work account, contact the responsible IT team; for suspicious banking activity, reach your bank through independently checked contact details. A password change alone does not necessarily resolve every consequence of unauthorised access.
2. Make a list without secrets
Record the names of affected services, how important they are and your progress. Actual passwords do not belong in an openly accessible spreadsheet, chat or AI prompt. You do not need to enter a password into an unfamiliar checking site either. A trusted manager you already use may identify repeated credentials. Review warnings directly in that manager or at the provider rather than following an unexpected message’s link. Keep even the list of account names private.
3. Rank accounts by what losing them would affect
For a preventive change, start with your main email and accounts used to recover other logins or sign into many services. Payment services, important shopping accounts and public social profiles are further priorities. In this fictional example, Elif finds she uses the same password for email and three older shops. She protects the mailbox first, then works through the shops. If that password has already been exposed, she treats every affected account as urgent, rather than making it a four-week project.
4. Change the password at the actual service
Open the genuine provider’s account settings. Generate a different password for each account and save the confirmed new value in your manager. Overwriting a saved entry alone changes nothing at the service. Then check that signing in works. Variations made by adding a shop name or changing the year remain predictable. A cosmetic monthly change does not replace unique credentials. Follow applicable rules for work accounts rather than trying to bypass the organisation’s technical requirements yourself.
5. Finish with a short account check
Check that recovery options are current and enable suitable additional sign-in protection. If a service supports passkeys, read its setup instructions and advice for losing a device. Record only the date and completion status in your private list, not the new secrets. You can close unused accounts through the official process after checking open orders, subscriptions and records you need. While a reused password still works there, the account remains an unfinished item on your list.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Should I change a unique password every month?
Routine changes using small predictable variations do not replace a strong, unique password. Known or suspected exposure requires action. Workplace accounts also follow your organisation’s requirements; discuss questions about those rules with its responsible IT team.
Am I finished after changing my email password?
No. That protects an especially important account but does not change passwords at other services. Work through every account still using the old password. After actual unauthorised access, also review active sessions, recovery settings and any changes someone else may have made.
Are passwords with the same beginning and different shop names different enough?
They are not identical, but follow a predictable pattern. Generate independent passwords instead and store them securely. Change them at each service. Altering the last character does not turn an exposed underlying pattern into a reliable new solution.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- NCSC: Password managersSource review date:
- NCSC: Password policy — updating your approachSource review date:
- BACS: Konto gehacktSource review date:
