Public explainers
Passwords, passkeys, and what to change after a leak
A leaked password is useful because people reuse it. A hash is still a reason to change it. A passkey is harder to phish than a code sent by SMS.
Reuse is the real problem
Most people have a short list of passwords they use in several places. When one service is reached without authorisation, the useful prize is often not that one login. It is every other account that shared the same secret.
A notice that “passwords were not taken” is a relief for that service. It is not a reason to keep a reused password on your bank, your mail or your tax space. If you used the same string anywhere else, change those other accounts first.
A hash is not a reason to wait
Some notices say passwords were stored as hashes: a one-way form that is not the password itself. That is better than storing the password in clear text. It is not a guarantee that nobody will ever recover a weak or reused password from the file.
Treat a hashed-password notice as a prompt to change that password, and to stop using it anywhere else. A password manager makes the next password unique, so one stolen file cannot open three services.
Codes you can read aloud are still phishable
Multi-factor authentication is useful. Not every factor is equal after a leak. An SMS code, or a code in an authenticator app, still has to be typed or read out. A caller who already knows your name, your number or your IBAN will ask you to read that code “to cancel a transfer” or “to secure your account”.
If your phone number was in a leak, SMS is the weaker option: the number is how they reach you, and the code is what they want you to say. Prefer an authenticator app you unlock yourself, or a passkey. Never read a code to someone who called you.
What a passkey changes
A passkey is a key stored on your device or password manager, unlocked with your face, fingerprint or device PIN. It is made for one site. A fake page that only looks like impôts.gouv.fr or your bank cannot collect a passkey the way it can collect a typed password.
Passkeys do not make you immune to a phone call. Someone can still ask you to approve a prompt, install software, or send money. The test stays the same: did you open the official app yourself, and did anyone ask you to hurry?
Check what these guides taught you. Take the quiz