Build a safe account cleanup plan without typing real passwords. Get a risk score, priority rotation order, and exportable checklist for replacing reused passwords.
Reuse risk
89/100
Critical risk. The rotation plan starts with accounts that can reset or expose everything else.
Risk
89/100
Critical
Rotation
9
Priority groups
First
Reset chain
Email, vault, money
Copy this checklist into a private vault or export it as a local text file. It intentionally avoids real passwords.
Password reuse audit checklist Risk score: 89/100 (Critical) Accounts to audit: 35 Known reuse: Not sure Critical account reuse: Not sure Password manager: Partial 2FA coverage: Mixed Exposure history: Not sure Priority rotation plan: 1. Primary email and recovery email 2. Password manager account 3. Banking, card, and payment accounts 4. Work, school, admin, and developer accounts 5. Apple, Google, Microsoft, and device sign-in accounts 6. Cloud storage and backup accounts 7. Social and messaging accounts 8. Shopping accounts with saved cards or addresses 9. Healthcare, insurance, tax, and government accounts Audit checklist: 1. [Do first] List account categories, not passwords - Group accounts by type: email, banking, work, cloud, shopping, social, devices, and subscriptions. Do not write real passwords in this tool. 2. [Do first] Rotate the account reset chain - Change primary email, Apple or Google, password manager, banking, and work passwords first. Use unique generated passwords saved in a private manager. 3. [Next 24 hours] Add strong 2FA to priority accounts - Enable passkeys, authenticator apps, or hardware keys for email, financial, work, cloud, and password manager accounts. 4. [Next 24 hours] Rotate reused groups from highest impact down - Work through financial, work, cloud, social, shopping-with-cards, healthcare, government, and then low-risk accounts. 5. [Next 24 hours] Move rotations into a password manager - Generate a different password for every account and save notes only in a vault you trust. 6. [This week] Remove stale sessions and saved cards - Review active sessions, app passwords, connected apps, payment methods, and recovery settings on accounts you rotated. 7. [This week] Create a clean maintenance rhythm - Set a quarterly reminder to check breach alerts, duplicate-password warnings, 2FA status, and old accounts you no longer use. Safety note: do not enter or store real passwords, backup codes, recovery keys, security answers, or account names in this export unless it is saved inside a private vault. Generated locally by https://passlock.to/tools/password-reuse-audit-checklist
Step 1
Primary email and recovery email
Step 2
Password manager account
Step 3
Banking, card, and payment accounts
Step 4
Work, school, admin, and developer accounts
Step 5
Apple, Google, Microsoft, and device sign-in accounts
Step 6
Cloud storage and backup accounts
Step 7
Social and messaging accounts
Step 8
Shopping accounts with saved cards or addresses
Step 9
Healthcare, insurance, tax, and government accounts
Group accounts by type: email, banking, work, cloud, shopping, social, devices, and subscriptions. Do not write real passwords in this tool.
A safe audit starts by mapping where reuse might exist without exposing secrets.
Change primary email, Apple or Google, password manager, banking, and work passwords first. Use unique generated passwords saved in a private manager.
These accounts can reset or unlock many other services.
Enable passkeys, authenticator apps, or hardware keys for email, financial, work, cloud, and password manager accounts.
Strong 2FA reduces the damage while password rotation is still in progress.
Work through financial, work, cloud, social, shopping-with-cards, healthcare, government, and then low-risk accounts.
Rotation order matters when time is limited.
Generate a different password for every account and save notes only in a vault you trust.
A manager makes the new unique-password baseline easier to keep.
Review active sessions, app passwords, connected apps, payment methods, and recovery settings on accounts you rotated.
Changing a password may leave older sessions or integrations alive.
Set a quarterly reminder to check breach alerts, duplicate-password warnings, 2FA status, and old accounts you no longer use.
Password reuse tends to come back unless the audit becomes a habit.
No. It is a planning checklist. Do not paste real passwords into this page.
Start with email, password manager, banking, work, cloud, and device sign-in accounts.
Use generated unique passwords, store them in a manager, and review duplicate-password warnings regularly.
Passlock for Mac · $14 lifetime
The browser is fine for one-off checks. The app keeps your passwords, passkeys, and notes locked behind your Mac — offline by default, no cloud account, no subscription.
Vault
All items
Bank · login
support@bank.com
iCloud
you@icloud.com
GitHub
@you
Email · personal
you@kitze.io