The argument I've heard against using the same password for two accounts on different websites is that if an attacker breaches one website and finds your password, they can then log in to your account on the other website.

However, if both of your accounts are on the same website, then theoretically if an attacker breaches that website, they can find both of your passwords, regardless of whether the passwords are different or not.

So is there an issue with using the same password in this situation?


If you consider a breach of the service and passwords are properly handled on the authenticating side, the attacker who gained access to the password database is left only with the brute-force attack.

Brute-force attack means checking exhaustively all possibilities, but does not limit the method to the dumbest "from 0000 to ZZZZ" one. That said, an attacker who expects users might create multiple accounts with the same password can easily modify the algorithm to check all accounts against each discovered password.

Whether this is an issue depends on you.

If you consider an attack on the client side, an attacker needs to learn one password from among multiple account-password pairs to learn all of them.

If you login to all accounts from the same machine, the attack surface remains constant, but if you use one account on a mobile device, the other on a secure PC, then one compromised device reveals the information about all accounts.

Again, given that you expressed the idea means other people think of it or do it too, and an attacker would probably take advantage of that (the cost is nil).

Whether this is an issue depends on you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.