One Account Changes Nothing

Add a single account and nothing happens yet. That is the point. A password only becomes a risk in relation to another password. Until a second card enters the picture, there is nothing to connect, and nothing for the map to show.

The Moment Two Cards Match

Pick “Uses the same password as” on a second account, and point it at the first. That one choice is the only thing the calculator needs. Behind the scenes, the two accounts are now tied together: if either password leaks, both become vulnerable. Add a third account that matches either of them, and it joins the same tie, even if it never pointed at the first account directly. This is also why a group can show more accounts than the connections you made by hand: the calculator follows every indirect link, not just direct ones.

A Different Password, The Same Door

Some accounts never share a password with anything, yet they are still not safe on their own. If an account resets its password through an email, and that email is caught up in a leaked password group, the account is reachable anyway, through the reset link rather than the password itself. The calculator keeps this apart from a shared password on purpose: “reachable through recovery” is a different kind of risk from “uses the same password”, and collapsing them into one number would hide which one is actually true.

Testing Every Password, One At A Time

Once the map exists, the calculator does something a static list of tips cannot: it tries giving every single account, one at a time, a brand new unique password, and checks what that would actually do to your worst case. Most of the time, the account worth changing is not the one you would have guessed by looking at the map yourself.

Why This Still Matters If You Use MFA

Two-factor authentication is one of the strongest defenses you have, but it protects a single login, not the password itself. A password that is shared across several accounts is still shared across several accounts even when some of them ask for a second step. The calculator counts MFA-protected accounts separately, inside each group, precisely because “protected” and “not sharing a password with anything else” are two different questions.

Watching The Map Answer Back

Hover over that one recommended change, and the map answers the question directly: it shows what your accounts look like the moment after that single password becomes unique, without you having to change anything yet. Move away, and it returns to exactly how things stand right now.