🔍 How to Do a Password Audit: Check Every Account in 30 Minutes (2026)
What is a password audit?
According to the Verizon 2025 Data Breach Investigations Report, 81% of hacking-related breaches involve stolen or weak passwords. A password audit is the fastest fix: a structured review of every credential you own to find the weak links before attackers do.
Think of it as a fire safety check for your digital life. You walk through every room, you spot what is missing or broken, and you fix it before there is an emergency. The difference is that a password audit has a clear checklist and a predictable time cost. Most people are done in half an hour.
Why it matters: the numbers
The scale of the credential problem is hard to grasp until you look at the data. The NordPass 2025 password study found that 73% of people reuse at least one password across multiple accounts. That number matters because of a technique called credential stuffing: attackers take a list of username-and-password pairs leaked in one breach and automatically try them against every other major site. If your email password and your banking password are the same, one breach exposes both.
The UK National Cyber Security Centre (NCSC) puts it plainly: "Using a unique password for every account is the single most effective defence against credential stuffing attacks."
A password audit is the practical way to find where you have failed to do that.
The three failure types an audit catches
| Type | What it means | The risk |
|---|---|---|
| Weak password | Short, predictable, or uses dictionary words or personal details | Can be cracked in seconds by brute-force tools |
| Reused password | The same password used on two or more sites | One breach exposes every account sharing it |
| Breached password | The password has appeared in a known data breach database | Attackers already have it and are testing it against other sites right now |
Before you start
You do not need any special software to do a basic audit. A notepad app or a plain text file works. What you do need is a rough list of accounts to check. If that sounds daunting, start with these five categories:
- Email. Gmail, Outlook, iCloud, Yahoo, or any work email.
- Banking and finance. Online banking, PayPal, investment apps, buy-now-pay-later accounts.
- Shopping. Amazon, eBay, any site that stores a saved card or address.
- Social media. Facebook, Instagram, X, LinkedIn, TikTok.
- Work and productivity. Google Workspace, Microsoft 365, Slack, Zoom, any HR or payroll portal.
If you already use a password manager, this step is already done. Your manager's vault is the list. Jump straight to the audit steps.
The 30-minute audit, step by step
Step 1: Build your account list (10 minutes)
Go through your email inbox and search for "verify your email", "welcome to", and "account created". Every registration confirmation in your inbox is an account. Add each one to your list. Do not try to be exhaustive on the first pass. Getting the 20 most important accounts covered is far more valuable than listing 200 and auditing none of them.
If you use a password manager, open the vault and sort by "last used" to surface the accounts you actually log into regularly.
Step 2: Spot reused passwords (5 minutes)
Go through your list and mark any accounts where you know the password is the same as another account. This is the highest-priority problem to fix. A single reused password shared across email, shopping, and banking is three accounts waiting to be taken over simultaneously.
Password managers make this automatic. The health check in NordPass, for example, flags every duplicate in your vault in seconds. If you are not using a manager yet, this is the step that will convince you to start.
Step 3: Run a breach check (5 minutes)
Go to haveibeenpwned.com and enter your email address. The site checks it against a database of over 14 billion credentials from confirmed breaches. Any match means attackers already have a version of your password. Write down which services returned a hit.
Check every email address you use. Many people have a personal address, a work address, and an old address they forgot about. All three need checking.
Step 4: Test password strength (5 minutes)
For each account on your list that is not already flagged as reused or breached, ask yourself three questions:
- Is it at least 16 characters long?
- Does it avoid dictionary words, names, or dates?
- Is it truly random, not a pattern like "Password1!" or a phrase you use elsewhere?
The US Cybersecurity and Infrastructure Security Agency (CISA) recommends a minimum of 16 characters for all important accounts, and prefers long random passphrases or machine-generated strings over short complex passwords. A password like X7#mP2qL is weaker than purple-lamp-rocket-cloud-77 because length matters more than symbol substitution.
Step 5: Fix your priority accounts first (5 minutes to start)
The full replacement process will take longer than 30 minutes if you have dozens of weak passwords. That is fine. The goal of the audit is to find them. Start with your email account, because every "forgot password" link for every other account goes to your email. One compromised inbox equals access to everything downstream.
After email, fix banking. Then shopping accounts with saved payment methods. Then social media. Work down the priority list in future sessions.
What to do with what you find
Every password flagged in the audit needs one of two actions: replace or secure further.
Replacing a weak or reused password
Use a random password generator, like the one at FreeStrongPassword.com, to create a new 20-character password for each flagged account. Save it in a password manager, not in a sticky note or a text file. Once you have replaced the password, enable two-factor authentication (2FA) on the account if the site offers it. Even if your new password is somehow stolen, 2FA means an attacker still cannot get in without a second code.
If a password appeared in a breach
Change it on the affected site immediately. Then search your account list for any other site where you used the same password and change those too. Prioritise this over everything else: breached credentials are sold and tested within hours of a database leak going public.
How often should you audit?
CISA recommends reviewing credentials at least once a year. Once every six months is better if you have more than 30 accounts. You should also run a targeted audit within 48 hours of any major breach announcement that names a service you use, even if you do not receive a direct notification. Breach notifications are often delayed by weeks or months.
The NCSC adds: "Changing your password only makes sense if you have reason to believe it has been compromised. Mandatory periodic changes often lead to weaker passwords." That means you do not need to change every password every quarter. You need to audit every year and act on what you find.
Tools that speed up the process
The manual method works, but these tools cut the time significantly.
| Tool | What it does | Cost |
|---|---|---|
| NordPass Password Health | Scans your vault for weak, reused, and breached passwords with a colour-coded health score | Free tier available |
| HaveIBeenPwned | Checks your email addresses against 14 billion+ leaked credentials | Free |
| Bitwarden Reports | Open-source manager with a built-in security report covering reuse, weak passwords, and breach exposure | Free (open-source) |
| Google Password Checkup | Chrome's built-in check for passwords saved in your Google account | Free (limited to Chrome-saved passwords) |
A dedicated password manager handles steps 2 and 4 of the audit automatically. If you are spending more than five minutes on manual checking, the time investment in setting up a manager pays off in the first audit.
Frequently Asked Questions
What is a password audit?
A password audit is a structured review of all your online account credentials to identify passwords that are too short, reused across sites, or found in a known data breach. The goal is to find and replace your weakest credentials before attackers find them first.
How long does a password audit take?
A manual first-pass audit covering 20 to 30 accounts typically takes 30 to 45 minutes. If you already use a password manager with a built-in health dashboard, the analysis takes under a minute. The time after that goes on actually replacing the flagged passwords.
How often should I audit my passwords?
Once a year at minimum, according to CISA guidance. Also run a targeted check within 48 hours any time a service you use confirms a data breach, regardless of whether you receive a personal notification from that company.
What should I do if I find a breached password?
Change it immediately on the affected site. Then check every other account where you used the same password and change those too. Enable two-factor authentication on the affected account. Breached credentials are often tested against other sites within hours of the database appearing in criminal marketplaces.
Can a password manager do the audit for me?
Most dedicated managers, including NordPass, Bitwarden, and 1Password, include a security health report that flags reused, weak, and breached passwords automatically. The audit view covers steps 2, 3, and 4 of the manual process in seconds. If you are not using a manager yet, starting one is the single biggest improvement you can make to your overall password security.