A breach warning: changing dozens of passwords without locking yourself out

One day your browser or your provider tells you that your passwords appeared in a leak. Changing them one by one, in a hurry, is how people lock themselves out of their own accounts. We went through it; here is the method that came out of it.

1. The order: vault first

It feels backwards, and it is what saves you: generate the new password, store it in your password manager first, then apply it on the service, then prove it with a real login. If storing fails, nothing has changed and the old password still works. If applying fails halfway, the password manager kept the previous value in its history (Bitwarden and Vaultwarden do), and you can still get back in.

2. Start where one password opens many doors

Group your accounts by password, not by importance. The dangerous ones are the passwords used in many places: one of them may open your bank, your tax account and your e-mail at once. Change the most reused first, and the accounts that can reset others (your e-mail above all) before everything else.

3. Prove every change

A change is done when you have logged out and back in with the new password, not when the form said "saved". Mark each proven entry (a note, a tag, a date in the entry): at the end, you know exactly what is done and what is not.

4. Turn on a second factor where it matters

For e-mail, banking, taxes and your password manager itself, add a second factor (an authenticator app). A leaked password alone then opens nothing.

Traps we paid for

An outdated entry is worse than an empty one. Entries imported long ago looked fine, but the accounts had changed since: most of their passwords no longer worked. An empty entry tells you to reset; a stale one makes you believe you still have access.

Some sites will not let a script change anything: captchas, phone confirmations, anti-bot walls. That is their purpose: proving a human is there. Keep those for yourself, and do not waste an evening trying to automate them.

Two folders with almost the same name in a vault is how a secret gets lost: one typo, and an entry lands where nobody will look. Clean the structure of your vault while you are in it.

Never store your vault's master password inside the vault. Write it on paper (Homelab 3).

Found this useful? Tell us what to measure next.