Owning a password manager does not mean you have unique passwords — one study found 94% used one and still reused most of their passwords

The advice is familiar to the point of being ignored: do not reuse passwords, get a password manager. What makes the research interesting is that the second half of that sentence turns out to be a much weaker fix than it sounds.

What the numbers actually say

Estimates converge in the same region. Roughly 80% of people reuse passwords in some form; the average password is reused about 2.7 times, and a typical user shares around eight passwords between accounts — including between work and personal ones.

The supply side is correspondingly large. Credential-stuffing lists hold on the order of two billion unique email addresses and over a billion passwords, and infostealer malware harvested something like 1.8 billion credentials in the first half of 2025 alone. Around 22% of breaches involve credential stuffing, and stolen credentials are the initial vector in roughly half of all breaches.

How the attack actually works

Credential stuffing is not guessing. It is a supply chain.

1. Harvest. Credentials come from breaches, from infostealer malware on an infected machine, or from phishing.
2. Stuff. Bots try each username-password pair against hundreds of unrelated services — banks, email, shopping, cloud storage, company logins.
3. Monetise. Whatever opens is used for fraud, resold, or used as a foothold into an employer.

The step most people underestimate is that this now includes pattern prediction. If a breached password was Summer2024!, modern tooling will try Winter2025!, Summer2025! and a long tail of variations. The common defence — reusing a base password with a small per-site tweak — is specifically the thing this defeats. A password that is 90% identical to a leaked one is not a different password.

The finding that complicates the standard advice

Here is the result worth sitting with. An academic study found participants reusing more than half of their passwords despite 94% reporting that they used a password manager. Only about 26% regularly used the manager to generate passwords.

That is a different problem from the one the advice addresses. These people installed the tool. They are storing passwords in it. They are still typing a password they invented and remember, and reusing it, and the manager is acting as a filing cabinet rather than as a generator.

Separately, only around 30% of people use a manager at all — so the picture is a minority using the tool, and a minority of those using the part that actually solves the problem.

What follows from that

1. Generating is the feature, not storing. If you are still choosing passwords yourself, the manager is not doing the job. Use the generate button, every time, and never look at what it produced.
2. Fix in order of damage. Email first — it is the reset path for everything else — then banking and anything holding payment details, then the rest. There is no need to do 200 accounts in one evening.
3. Turn on a second factor where it matters, ideally a passkey or an authenticator app. Credential stuffing fails against an account that needs something more than a password, which is why a single correct password is no longer the whole defence.
4. Check your own exposure. Breach-notification services will tell you which of your addresses appear in known dumps. Anything that appears there should be changed, not varied.

Sources: Enzoic's password-reuse statistics; DeepStrike's credential-stuffing research; the Verizon Data Breach Investigations Report; the academic password-manager usage study; and Prothom Alo's original report.