What actually happens when a password leaks

Every piece of password advice you have been given is downstream of what happens after a company is breached. It is worth five minutes, because it explains which of that advice matters and which of it never did.

5 min read · last checked 2026-09-07

Advertisement

“Use a strong password” is advice without a reason attached, which is why so few people follow it properly. The reason lives in what happens after a company you signed up to gets broken into — and once you have seen that, the rest of the advice sorts itself into the parts that matter and the parts that never did.

The tool Password Generator Strong passwords and passphrases, made on your machine and never transmitted anywhere.

The site should not have your password at all

A well-built site does not store what you typed. It stores a hash: the output of a one-way calculation. Feeding the same password in always produces the same hash, and there is no way to run the calculation backwards.

So when you log in, the site hashes what you typed and compares it with the hash it has. It never needs the original, and it never has it.

That is the theory, and it is why a breach is not automatically a catastrophe. Whether it is one in practice depends on two details that nobody outside the company can see from the outside.

Detail one: salt

If a site hashes passwords with nothing else added, every account using the same password gets an identical hash. An attacker who works out one has worked out all of them at once, and can spot the most common passwords just by looking for repeated values.

A salt is a random value stored alongside each account and mixed in before hashing. Identical passwords now produce completely different hashes, so each one has to be attacked separately, and precomputed tables of common hashes are useless.

Salting is not new and is not optional in any serious system. Breaches that make headlines for exposing millions of passwords are frequently breaches of systems that skipped it.

Detail two: how slow the hash is, which sounds backwards

This is the part that surprises people, and it decides everything.

Hashes built for speed — the ones designed to fingerprint files quickly — can be computed on ordinary graphics hardware at rates in the billions per second. Those are exactly the wrong tool for passwords: the attacker with the stolen list gets to make billions of guesses a second against it.

Hashes built for passwords are deliberately, expensively slow, and can be tuned slower as hardware improves. The same graphics card manages perhaps tens of thousands of guesses a second instead of billions. Those numbers are orders of magnitude rather than precise figures — they depend on the hardware and the settings — but the gap between them is the whole point, and it is a gap of roughly a million times.

Same stolen file, same password. Against the fast hash, a weak one falls in seconds. Against the slow one, the same guessing run would take longer than anyone will wait.

Then the part that is actually about you

Everything so far is the company’s decision, not yours. Here is the part that is yours, and it is the one that does the damage.

Once a set of email addresses and passwords is out, the next step is not to attack anything. It is to take those exact pairs and try them, automatically, at hundreds of other sites — banks, shops, mail providers, social accounts. This is called credential stuffing, and it does not involve guessing at all. It is just typing in an answer that is already known.

It works for exactly one reason: the same password was used somewhere else.

A diagram: a site is breached, it stored hashes rather than passwords, and whether those were salted and slow to compute decides how fast the list falls. Then the pairs are tried at other sites, and either the password was reused and they are in, or every account had its own and the chain stops.
The first three steps are the breached company’s decisions. The fork at the bottom is the only part your own habit decides.

So notice what that means. If every account has its own password, a breach is confined to the site that was breached. The strength of the password barely enters into it — a stuffing attack does not care how strong yours is, only whether it is the same one. A weak, unique password is safer against this than a very strong, reused one.

That is the whole argument for a different password everywhere, and it is a better argument than “because it is more secure”.

The advice that got reversed

For years the standard rule was to change every password every ninety days, and to require an uppercase letter, a digit and a symbol.

Both have been walked back by the people who wrote them, including in the United States’ own federal guidance, and the reason is that both produced worse passwords in practice rather than better ones:

  • Forced rotation made people cycle predictably. Summer2024! becomes Autumn2024!. An attacker who has one has a very good idea of the next.
  • Composition rules made people decorate the same word the same way — capital at the front, digit and exclamation mark at the end. A guessing program knows that pattern perfectly well, so the rule widened the alphabet on paper and narrowed the real search.

The current guidance is the opposite in both cases: allow long passwords, do not force periodic changes, and check new passwords against lists of ones already known to have leaked. Change a password when there is a reason to — not on a calendar.

If you want to see what that looks like from the guessing side, the strength checker breaks a password into the pieces a guesser would recognise and prices each of them, which is usually more persuasive than being told.

What follows from all this

Four things, in the order they matter:

  • A different password for every account. This is the one that stops a breach spreading, and nothing else does.
  • Something to remember them with. Nobody memorises forty. A password manager is the ordinary answer; a notebook that never leaves your house is better than reuse.
  • Two-factor authentication where it is offered, and especially on the mailbox everything else resets through. A stolen password alone stops being enough.
  • Length over decoration. Once each password is unique, longer is the lever that still helps — and a generated one has no pattern for a guesser to find.

Notice that only the last of those is about the password itself. The advice everybody repeats is the least important item on the list.

Advertisement
Advertisement

Both of these run on your machine

Neither transmits what you type. For a password that is not a nicety — a generator that sends its output somewhere has defeated its own purpose.

Common questions

What happens when a website is breached?

Attackers take the account database, which should contain hashes rather than passwords — a one-way calculation that cannot be reversed. How much that protects you depends on whether each password was salted, so identical passwords do not produce identical hashes, and on whether the hash was a slow one built for passwords or a fast one that can be attacked billions of times a second.

Why is reusing a password so dangerous?

Because after a breach the next step is not guessing. The leaked email-and-password pairs are tried automatically at hundreds of other sites — credential stuffing — and that works only where the same password was used again. A weak but unique password is safer against this than a very strong one you have used in several places.

What is a salt, and why does it matter?

A salt is a random value stored with each account and mixed into the password before hashing. Without one, every account using the same password has the same hash, so cracking one cracks them all and precomputed tables of common hashes work. With one, every password has to be attacked separately.

Should I change my passwords every few months?

No, and the guidance that said so has been withdrawn by the bodies that issued it, including the United States’ federal standard. Forced rotation made people cycle predictably — Summer2024 becoming Autumn2024 — which helps a guesser rather than hindering one. Change a password when there is a reason to think it has been exposed, not on a schedule.

Do I still need an uppercase letter, a number and a symbol?

Those rules have also been dropped from current guidance, because they produced the same pattern from everybody — a capital at the front and a digit and a symbol at the end — which a guessing program handles easily. They widened the alphabet on paper while narrowing the real search. Length and unpredictability are what actually help.

Is a password manager safe?

The relevant comparison is not against perfection but against what people do instead, which is reuse. A manager makes a unique password per account practical, and unique passwords are the single thing that stops one breach spreading. If software is not for you, a notebook kept at home is still far better than the same password everywhere.

How would I know if my password has leaked?

You often would not, from your side — the first sign is usually a login you did not make. Services exist that let you check whether your email address has appeared in a known breach, and many browsers and password managers now warn you automatically. Two-factor authentication is what limits the damage when it happens anyway.

More guides

What is a HEIC file, and why will your PC not open it?

Half the size of a JPG, and a patent licence is why Windows refuses it.

How to get a PDF under an upload limit

Most PDFs cannot be compressed at all. Ten seconds tells you which kind you have.

Why WhatsApp ruins your photos, and how to send one properly

It re-compresses every picture you send. There is one way around it, and it is not the quality setting.

JPG or PNG: which should you use?

Photographs, JPG. Hard edges or transparency, PNG. The reason is worth two minutes.

How to get a photo under a KB limit

The quality slider is the wrong first move. Pixels are the lever that works.

Are QR codes safe? What is actually inside one

Nothing inside one can run. The risks are the destination, the sticker over the original, and who owns the code.

Why video files are so big, and what actually shrinks them

Bitrate times length is the file size. Everything else follows from that.

MP3, WAV or M4A: which audio format, and at what bitrate?

128 kbps is about a megabyte a minute. Everything else follows from that.

Percentages, and the four sums people actually get wrong

20% off then 10% off is not 30% off, and adding 20% then taking it back leaves you short.

How to take a passport photo at home that is not rejected

The rule is the height of your head, not the size of the photo — and the shadow behind you is geometry.

How to make a ringtone, and why the cutting is the easy part

Android takes an MP3 straight. An iPhone wants an M4R, which is an M4A with a different extension.

Compound interest, in both directions

Savings growing and a card balance running away are the same sum. Only the side you are standing on differs.

Advertisement