How can I replace reused passwords without changing every account at once?

No. Treat it as a transition with small, trackable steps, not one giant session. The goal is to stop reusing passwords by replacing each reused one with a long, unique, random password. CISA recommends reviewing existing passwords and changing ones that do not meet that description; it also recommends using a password manager to store passwords. [S1]

CISA’s guidance does not prescribe which accounts to change first or a schedule. The order below is a practical way to manage the work, not a sequence CISA specifies.

Make a private working list of accounts and group them by how important access to each one is to you. For example, you might put your main email account near the top because you rely on it for important messages, then list financial, work, social, shopping, and entertainment accounts according to your own priorities. CISA specifically identifies email and social media as valuable accounts to include in an inventory. [S1]

That example is a planning aid, not an official ranking. If you are unsure where an account belongs, mark it for review rather than delaying the whole project. Avoid putting actual passwords in an ordinary note or this guide; use a storage method you choose, such as a password manager.

Start with accounts you can readily recall: services you use often, accounts that send you messages, and sites where you know you reused a password. Add others as you encounter them. You do not need a perfect inventory before taking the first step.

A simple tracker could look like this:

Account or service: [name] Importance to me: [high / medium / lower] Password reused elsewhere? [yes / no / unsure] Next action: [change / check / find account] Done: [ ]

Keep the tracker free of passwords. It is only a list of work to do. If the account name itself is sensitive, use a label that makes sense to you.

Suppose, as a hypothetical example, your list has [main email], [social account], [shopping account], and [old forum]. You discover that the same password is used for the first three. Pick a small batch you can finish in one sitting—perhaps the email account first, then the social account in a later session. For each one, change the password to a different long, unique, random one and store it in your chosen password manager. [S1]

Then update the tracker and choose the next account or batch. You can work by a simple rule such as “one or two accounts when I have time,” but that is just a manageable personal target, not a recommended official timetable. If a site’s password-change process is unclear, use that service’s own help information rather than guessing.

Mark uncertain accounts as “check” and continue with one you can address confidently. When you return to the uncertain account, review your own records or the service’s account options; do not try to reconstruct passwords by writing them into the tracker. If you cannot identify an account or complete its change, leave a brief note about the next step you need to take.

To maintain momentum, make the finish line visible: each account moves from “not reviewed” to “checked,” then to “changed” when you have replaced a reused password. At the end, scan the list for accounts still marked “yes” or “unsure.” The source guidance supports reviewing and changing passwords that are not long, unique, and random, but it does not establish a particular tracking method or timetable. [S1]

Create the tracker, add a few accounts you know you use, and mark any password reuse you already recognize. Choose one important account and replace its reused password with a long, unique, random one; consider storing it in a password manager. Then record that it is done and pick the next small batch when you are ready. This turns a large cleanup into repeatable steps without requiring you to change every account at once. [S1]