I've probably made accounts with 100+ or so different websites or services. Eventually this turns into a game of statistics: https://haveibeenpwned.com/ https

I've probably made accounts with 100+ or so different websites or services. Eventually this turns into a game of statistics: https://haveibeenpwned.com/ https://haveibeenpwned.com/ lists no less than 6 mass breaches my account details have ended up in through no fault of my own, all of them including at least email addresses and password hashes (if not plaintext passwords) (edit: Actually, I've recalled at least a 7th service that has been compromised that HIBP doesn't list) That's either 6 times my bank account password gets leaked... or 0 times if I use unique passwords. I strongly suspect there are more breaches that HIBP simply isn't aware of with my information in them. Additionally, I need to rotate either 600 (!) or merely 6 different passwords to re-secure my accounts. So, obviously, unique passwords are a big win here. > If your passwords are hosted encrypted on a website, then if that website is breached, the master password you send it will be visible to the attacker, and thus all passwords are breached. I use an offline password manager specifically because of this reason. Still, needing to pwn any of 5 targets to get my bank account (me, my bank, my password service, my email provider, or my phone provider) isn't much worse than needing to pwn any of 4 targets (me, my bank, my email provider, or my phone provider), and both are much better than needing to pwn any of 100+ targets, some of which have terrible security and are probably already pwned without even knowing it. So, options for unique passwords: Memorize 100+ strong unique passwords: I "can't" do this. Memorize 100+ weak unique passwords: Too weak to brute force attacks for my tastes. Use a memorizable unique password generation scheme: Not unique enough for my tastes. Memorize a few very strong unique passwords and use a password manager. This does have the weakness that capturing my master passwords via keylogger will get you all my accounts, instead of just all the important ones that I regularly use - but since "all the important ones that I regularly use" includes my email, that's just as good as pwning all of my accounts in my book.