Give your email its own password; do not reuse it on any website

Passwords stolen from other sites get tried on your email directly. Once someone is in your email, every account that can reset its password through that email is lost too. So the email password stands alone; do not use it anywhere else.

Cost

No cost. A password manager can store it so you do not have to memorize it. The hard part is breaking the habit of one password everywhere.

Benefit

Trying leaked account-and-password pairs from elsewhere against your logins is called credential stuffing, and your email gets tried this way too. Once someone is in your email, every account that uses it for password recovery goes with it. The US Cybersecurity and Infrastructure Security Agency recommends a different strong password for every account, at least 16 characters, stored in a password manager

Notes

If you cannot memorize them, use your browser’s built-in password manager. It remembers each site’s password for you, which is far stronger than reusing one password everywhere. Do not store passwords in WeChat favorites or notes.

Sources · 1

1. US CISA. Use Strong Passwords. cisa.gov/secure-our-world/use-strong-passwords