Loading page
About this tool
Map your accounts to password families in the browser to find reuse clusters and see which one to break first.
Password Reuse Self Audit Sheet groups your accounts into reuse clusters from nicknames you give each shared password — it never asks for the password itself. Each account is weighted by what an attacker would actually reach, with your primary email and password manager ranked highest because nearly every other reset link is delivered through them. The output is the percentage of your account value sitting behind a shared password, the clusters that create it, and the order in which to change them. The attack being modelled is credential stuffing: a username and password pair leaked from one breached site, replayed automatically across hundreds of others.
Open Password Reuse Self Audit Sheet on AltFTool — it loads instantly in your browser.
Paste or type the text you're working with.
Choose how it should be transformed or analyzed.
Copy the finished text into your document or post.
You type nicknames like 'the 2019 one', so the sheet works without handling a single real secret.
Clusters are ranked by the value they expose, not by how many accounts they contain.
The clustering runs in your browser tab; nothing is uploaded, saved or sent anywhere.
Because strength stops mattering once the password has leaked. In credential stuffing, an attacker takes username and password pairs from one breached site and replays them automatically across other services — the pair only has to match. A 20-character password reused on a forum that gets breached is as usable to the attacker as a weak one.
The one on your primary email or password manager, if either shares a password with anything else. Password resets for your other accounts are delivered to that inbox, so it is the account that unlocks the rest. After that, work down by value: banking and government, then work and cloud storage, then everything else.
Yes. Attackers run rule-based mutations — appending digits, swapping letters for symbols, incrementing a year — over the passwords they already have, so 'Summer2019!' and 'Summer2020!' belong in the same family here. Label them as one family unless the two passwords share no common base.
No. It only ever receives the account names, tier choices and family nicknames you type, and it processes them in your browser. Nothing is transmitted to a server and nothing is written to storage, so closing the tab clears the sheet.