Most people do not need a perfect vault. They need a safer vault this week than last week. A focused 30-minute pass can cut real risk quickly if you prioritize the right accounts first.
The 30-minute plan
Simple sprint format
| Time | Action | Outcome |
|---|---|---|
| 0-10 min | Fix reused passwords on top-priority accounts | Stops one-breach-many-account risk |
| 10-20 min | Upgrade weak passwords and regenerate where possible | Improves brute-force resistance |
| 20-30 min | Review stale credentials and archive dead entries | Reduces clutter and attack surface |
Priority order that works
- Email and identity providers
- Banking and payment accounts
- Work and developer platforms
- Travel, shopping, and lower-impact accounts
Consistency beats intensity. Run this once now, then repeat monthly. Zen Passwords password-health style insights are built for exactly this kind of practical maintenance rhythm.
Before the clock starts
- Your vault open on the device you use most, so you are not fighting sign-ins while you work
- A list of your top ten accounts, which is usually shorter than people expect
- Somewhere to note accounts you cannot fix today, so they are not lost
What each block of ten minutes actually looks like
The table above is the shape of the sprint. This is what each block involves in practice, so you are not deciding what to do while the clock runs.
- Reused passwords first. Find the password you have used on more than one site and change it on the account that matters most, then on the next. One breach elsewhere is what turns a reused password into a problem you did not cause.
- Weak passwords next. Anything short, guessable or older than you would like gets regenerated. Length beats cleverness: a long generated string you never type is stronger than a memorable one you reuse.
- Stale entries last. Old logins for services you no longer use are still data about you sitting somewhere. Close the account if you can, and archive the entry if you cannot.
Accounts you cannot fix today
- Services that force a weak password format: note them, and set a reminder to check again in six months
- Shared logins with family or colleagues: changing these needs a conversation, not a sprint
- Accounts tied to a device you no longer have: recover access first, change the password second
Keeping it healthy after the sprint
Thirty minutes a month keeps this from ever being a project again. Add one-time codes to the accounts that offer them, so a stolen password alone is not enough, and turn on passkeys where a service supports them properly. The passkey guidecovers the order that avoids lockouts.
If your credentials are still spread across another manager, do the import first and the clean-up second, otherwise you will fix the same password twice. The migration guidewalks through the export, the import and the checks afterwards.
Why "change every password" is bad advice
Told to fix their passwords, most people either change nothing or try to change everything, run out of patience around account eleven, and leave the list half done in a way that is worse than where they started.
The reason it fails is that it treats every account as equally risky, and they are not. A handful of accounts can be used to take over all the others, and everything else is noise by comparison.
The tiers, in the order that actually matters
Where thirty minutes should go
| Tier | Accounts | Why first |
|---|---|---|
| 1 | Email, then your phone carrier account | Both can reset almost everything else |
| 2 | Banking, payments, anything with a card stored | Direct financial loss |
| 3 | Apple ID or Google account | Holds your devices, backups and location |
| 4 | Anything reused anywhere | One breach elsewhere becomes a breach here |
| 5 | Everything else | Genuinely can wait |
Email is first and it is not close. Almost every other account on the list has a "forgot password" link pointing at it, which means whoever controls your inbox controls the rest by design.
The thirty minute pass
- Open your vault’s health or audit view and sort by reused rather than by weak. Reuse is the one that turns somebody else’s breach into yours.
- Fix email first. New unique password, then turn on two factor if it is not already, then check the recovery phone and address are ones you still control.
- Do the same for the phone carrier account, because a number takeover defeats SMS codes on everything else.
- Work down tiers two and three. Five accounts is a realistic number for one sitting and it is most of the actual risk.
- Set a reminder for the same time next month and stop. Half an hour a month beats one heroic afternoon you never repeat.
The checks people skip, which are the ones that matter
- Old recovery addresses. A forgotten address from a previous job is a live key to your account.
- Active sessions. Signing out everywhere is the step that actually removes an intruder who already has access.
- App passwords and connected apps, which survive a password change and often nobody remembers granting them.
- Security questions answered honestly. A truthful mother’s maiden name is public information; a random string in your vault is not.
None of this needs new software. It needs one ordered pass, done in the right order, and stopped before it becomes the kind of chore you avoid next time.
