Password Reuse Is Still Everywhere: The 2025 Data
Studies consistently find 50–65% of people reuse passwords. Here is the updated 2025 data and what it means for your personal and organisational risk.
The numbers are worse than you think
The statistics on password reuse have remained stubbornly consistent across years of research: approximately 65% of people reuse the same password across multiple sites. Around 45% reuse the exact same password on all their accounts. Despite a decade of "don't reuse passwords" messaging, the behaviour hasn't meaningfully changed.
This isn't a knowledge problem. Most people know password reuse is bad. It's a cognitive load problem — managing unique credentials for dozens of accounts is genuinely hard without tools designed for it.
What credential stuffing data tells us
When a major breach is published — a database of 100 million email/password pairs from a gaming site — security researchers and threat intelligence firms track what attackers do with it. The pattern is consistent:
- Within hours, automated credential stuffing begins against major email providers, banking sites, and e-commerce platforms
- Success rates on high-value targets (financial accounts) typically range from 0.1% to 2%
- On a 100 million credential set, a 0.5% success rate means 500,000 account takeovers
- Attackers specifically target accounts where the stakes are high — banking, email (used for password reset), crypto exchanges
Why the behaviour hasn't changed
Research from Carnegie Mellon and other institutions has identified why people continue reusing passwords despite knowing the risk:
- Perceived low risk: "My Netflix password being leaked doesn't matter" — without understanding that credential stuffing tries every site
- Password manager friction: Setup feels complicated; people underestimate how much easier it makes things once configured
- Account complexity: The average person has 100+ online accounts. Managing unique credentials feels impossible without a tool
- Reset safety net: "I can always reset it" — underestimating how many accounts use the same email that could also be compromised
What interventions actually work
Research on behaviour change in password security points to two consistently effective interventions:
- Password managers with autofill: The friction of using unique passwords drops to near zero when a manager fills them automatically. Adoption of unique passwords correlates strongly with password manager use.
- Breach notifications with forced resets: Firefox Monitor and Google's Password Checkup have shown that proactive breach notifications with a one-click "change password" flow achieve significantly higher remediation rates than passive advice.
What doesn't work: repeated reminders, awareness campaigns alone, or complexity requirements (which cause users to make minimal variations: Password1 → Password2).
Start by checking your own credentials with PassGeni's Breach Checker — it's the fastest way to see exactly what's been exposed.