breaches leak stored hashes, not typed characters; reuse turns one leak into every account
A strong password stops being strong the moment it is used on a second site. If that site is breached, the attacker obtains a hash of your password, cracks it offline, and then tries the recovered password everywhere else. Strength protects the account it was created for; uniqueness protects every other account.
Sites do not store your password. They store a hash, a one-way mathematical digest. When you log in, the site hashes what you type and compares digests. An attacker with the database cannot read your password, but they can guess: try a candidate, hash it, compare. If it matches, they have your password. Salting adds random text before hashing, so identical passwords produce different hashes and cannot be cracked in bulk. But salt only forces the attacker to crack each hash separately; it does not stop them from cracking yours.
A 12-character random password from a 62-character alphabet has about 3.2 × 10^21 possibilities. Even at a billion guesses per second, the average search would take about 50,000 years. That is why a strong password is genuinely hard to crack on the site that stores it. But if you reuse that same password on a site with a weaker hash or a faster algorithm, the attacker does not need to crack the strong site. They crack the weak one and then use the recovered password everywhere.
People treat "strong password" as "safe password." The real threat is not someone guessing from scratch; it is someone taking a leaked password and trying it at every major site. This is called credential stuffing. After a breach, automated scripts run through millions of email and password pairs. A password can be mathematically strong and still leak because it was stored by a site that was not. Another confusion is calling a hash "encryption." Encryption is reversible with a key; hashing is not. You cannot undo a hash, only guess and compare.
No password survives a site that stores plaintext, a phishing page that asks for it directly, or malware that logs keystrokes. A unique strong password also fails if your password manager's master password is weak, because that one password guards all the others. And a unique but weak password can still be cracked if the site uses a fast hash. The practical rule is therefore not "make strong passwords." It is: assume every password will leak, and make sure one leak does not chain into other accounts. Use a password manager to generate a long random password per site, and enable two-factor authentication on the accounts that matter most.
Cram I use a strong password, so a leak cannot get me, right?
Rep It can. Breaches do not leak your typed password, they leak the stored version. The whole question is how that stored version is protected.
Cram Wait, if it is stored differently, why is a strong password not enough?
Rep Because a cheap fast hash is not a safe one. Attackers steal the file and guess billions of passwords a second until one matches.
Cram But I thought passwords were always scrambled before being saved.
Rep Well built sites run a one way hash, so the original cannot be recovered from what is stored. Weak sites save the plain text itself.
Cram So the weakness is in how the site saves it, not in my password?
Rep Right. That is why good systems add salt and use slow hashing, so each guess costs more. A long random password also makes guessing useless.
Cram So if my password is long and random, I am safe then?
Rep From that breach, mostly. But some other site can leak you, and if you reused the password, that single leak opens every account that shares it.
Cram I have definitely reused a password or two.
Rep That is the danger. Attackers take stolen lists and try them everywhere. Reuse is what turns a small breach into a full takeover.
Cram So strong is not the real goal, unique is?
Rep Both, but unique is the one that saves you. A password manager can generate and remember each one, so every site gets its own key.