{"id":50,"date":"2026-10-31T14:00:02","date_gmt":"2026-10-31T14:00:02","guid":{"rendered":"https:\/\/passwordideas.net\/blog?p=50"},"modified":"2026-10-31T14:00:02","modified_gmt":"2026-10-31T14:00:02","slug":"adding-website-name-to-password-for-each-account","status":"publish","type":"post","link":"https:\/\/passwordideas.net\/blog\/adding-website-name-to-password-for-each-account\/","title":{"rendered":"Adding Website Name to Password for Each Account: Is It Safe?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Adding website name to password for each account makes the passwords look different, but it does not make them independent. If one full password is exposed, the shared base and the pattern may be easy to infer. CISA recommends a long, random, different password for every account, so generate separate ones instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/passwordideas.net\/\" title=\"Secure Password Generator\">Secure Password Generator<\/a> on this site creates random passwords with the length and character types you choose, and it runs in your browser. Below I explain the risk calmly, what NIST and CISA actually say, and a short plan to switch.<\/p>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li class=\"\"><a href=\"#how-does-adding-website-name-to-password-for-each-account-work-1\">How does adding website name to password for each account work?<\/a><\/li><li class=\"\"><a href=\"#what-happens-when-one-complete-password-is-exposed-2\">What happens when one complete password is exposed?<\/a><\/li><li class=\"\"><a href=\"#what-does-nist-actually-say-about-service-names-3\">What does NIST actually say about service names?<\/a><\/li><li class=\"\"><a href=\"#does-adding-website-name-to-password-for-each-account-make-it-unique-4\">Does adding website name to password for each account make it unique?<\/a><\/li><li class=\"\"><a href=\"#how-do-i-move-to-a-separate-password-for-each-account-5\">How do I move to a separate password for each account?<\/a><\/li><li class=\"\"><a href=\"#developer-note-how-should-a-login-system-treat-service-names-6\">Developer note: how should a login system treat service names?<\/a><\/li><li class=\"\"><a href=\"#frequently-asked-questions\">Frequently asked questions<\/a><\/li><li class=\"\"><a href=\"#next-steps\">Next steps<\/a><\/li><li class=\"\"><a href=\"#sources\">Sources and further reading<\/a><\/li><\/ul><\/nav><\/div>\n\n\n<div class=\"wp-block-image pwi-auto-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-1-47-1-fdbb33d67f0df867-1024x576.jpg\" alt=\"Several similar keys on one ring with different tags, representing a shared base password with site-specific endings\" class=\"wp-image-54\" srcset=\"https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-1-47-1-fdbb33d67f0df867-1024x576.jpg 1024w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-1-47-1-fdbb33d67f0df867-300x169.jpg 300w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-1-47-1-fdbb33d67f0df867-768x432.jpg 768w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-1-47-1-fdbb33d67f0df867.jpg 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"how-does-adding-website-name-to-password-for-each-account-work-1\">How does adding website name to password for each account work?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A shared base password is one strong password reused as the core of many logins. The habit is popular because it feels like a compromise: you invent one long base, then add a word tied to each site, so every account ends differently. As a schematic, two accounts look like this:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Email account: <code>SharedBase + EmailSiteName<\/code><\/li>\n\n\n\n<li>Shopping account: <code>SharedBase + ShopSiteName<\/code><\/li>\n\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These are two different strings, but they are not independent secrets. Independent means that learning one tells you nothing about the other. Here, both depend on the same base and the same rule.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Changing the ending changes the text, yet a site name is public information, so it adds very little secrecy once the rule is known. A long base that nobody has seen is not automatically easy to guess. The real concern is the single point of failure it creates across all your accounts.<\/p>\n\n\n<div class=\"wp-block-image pwi-auto-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-2-47-2-042c339c3cce46e1-1024x576.jpg\" alt=\"One key opening a row of similar doors, illustrating how one exposed password can affect related accounts\" class=\"wp-image-56\" srcset=\"https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-2-47-2-042c339c3cce46e1-1024x576.jpg 1024w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-2-47-2-042c339c3cce46e1-300x169.jpg 300w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-2-47-2-042c339c3cce46e1-768x432.jpg 768w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-2-47-2-042c339c3cce46e1.jpg 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"what-happens-when-one-complete-password-is-exposed-2\">What happens when one complete password is exposed?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Passwords can be exposed in different ways. A readable password might be captured by a phishing page, by malware, or by a poorly built site. Or a site might lose a hash, which is a one-way scrambled version of a password that sites store instead of the password itself. A hash alone does not reveal your base. The risk depends on what was exposed or captured.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Credential stuffing means trying a username and password stolen from one site on other sites. OWASP describes it in terms of credentials obtained from another site, and the basic version tries the stolen pair unchanged. Guessing related variants is an additional step, and I am not claiming every attacker takes it. But if a complete password becomes readable, the pattern is visible, and site names are public. That leaves the ending with little protective value.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The UK NCSC warns that people fall back on variations of passwords they already know, and that such variations can look strong to a strength meter. A score judges one string on its own, not a family of related passwords. If you want to see why numbers can mislead, read about <a href=\"https:\/\/passwordideas.net\/blog\/high-password-entropy-but-weak-strength-score\/\" title=\"High Password Entropy but Weak Strength Score: Why It Happens\">why strength scores and entropy can disagree<\/a>. Entropy is a measure of how unpredictable a password is.<\/p>\n\n\n<div class=\"wp-block-image pwi-auto-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-3-47-3-e771cc218256f8a2-1024x576.jpg\" alt=\"Guidance document and magnifying glass representing NIST advice about service names in passwords\" class=\"wp-image-58\" srcset=\"https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-3-47-3-e771cc218256f8a2-1024x576.jpg 1024w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-3-47-3-e771cc218256f8a2-300x169.jpg 300w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-3-47-3-e771cc218256f8a2-768x432.jpg 768w, https:\/\/passwordideas.net\/blog\/wp-content\/uploads\/2026\/10\/adding-website-name-to-password-for-each-account-image-3-47-3-e771cc218256f8a2.jpg 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\" id=\"what-does-nist-actually-say-about-service-names-3\">What does NIST actually say about service names?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NIST SP 800-63B Revision 4, finalized in July 2025, lists context-specific words as expected password content. That includes the name of the service and its derivatives. A verifier, meaning the service checking your login, should compare a proposed password against a blocklist containing such words.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The nuance matters. NIST requires comparison of the entire proposed password. It does not say every password containing a site name is unsafe, and it does not reject a password merely because a name appears inside it. The takeaway for you is narrower: a service name is predictable, so it is a poor thing to rely on for uniqueness.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">NIST also advises against forced character-type mixtures and against routine password changes without evidence of compromise. Its 15-character minimum for a password used as the only authentication factor is a requirement for verifiers, not a claim that a shorter password is broken. For consumers, CISA&#8217;s September 2024 tip sheet recommends passwords that are at least 16 characters, random and different for each account. The UK NCSC also recommends a unique password for each online account.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"does-adding-website-name-to-password-for-each-account-make-it-unique-4\">Does adding website name to password for each account make it unique?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It makes the text unique, not the secret. A different suffix is not the same as a separate password for each account. Here is how the approaches compare:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Approach<\/th><th>Do accounts depend on each other?<\/th><th>What one exposed password may reveal<\/th><\/tr><\/thead><tbody><tr><td>Shared base plus site name<\/td><td>Yes, same base and same rule<\/td><td>Possibly the base and the pattern<\/td><\/tr><tr><td>Separately generated random password<\/td><td>No<\/td><td>Nothing about your other accounts<\/td><\/tr><tr><td>Passkey, where supported<\/td><td>No, one per service<\/td><td>Nothing reusable elsewhere<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">A passkey is a login method that replaces a typed password with a cryptographic key stored on your device. The FIDO Alliance describes passkeys as unique and bound to the online service&#8217;s domain. Appending a domain name to a password does not give it that property.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/passwordideas.net\/password_strength_tester\" title=\"Password Strength Checker\">Password Strength Checker<\/a> can test one password for length and common patterns in your browser. Keep its limit in mind: a good score for one string cannot show that a family of related passwords is safe after the pattern is exposed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-i-move-to-a-separate-password-for-each-account-5\">How do I move to a separate password for each account?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You do not need to fix everything in one evening. Work through these steps, most important accounts first:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Start with email and money. Email can reset your other accounts, so see the <a href=\"https:\/\/passwordideas.net\/password-ideas\/email\" title=\"Email\">password ideas for email accounts<\/a>, then replace banking and shopping logins next.<\/li>\n\n\n\n<li>Generate a new password for each account with the Secure Password Generator. Aim for at least 16 characters where the service allows it, following CISA. If you have many to replace, the <a href=\"https:\/\/passwordideas.net\/bulk_password_generator\" title=\"Bulk Password Generator\">Bulk Password Generator<\/a> can create several at once, but treat any exported file as sensitive and delete it after saving the passwords.<\/li>\n\n\n\n<li>Save each one in a reputable password manager or the one built into your browser. You will not need to memorize a formula.<\/li>\n\n\n\n<li>Choose new passwords that do not contain your old base, even in part.<\/li>\n\n\n\n<li>Turn on multifactor authentication where it is offered.<\/li>\n\n\n\n<li>Check for exposure. The <a href=\"https:\/\/passwordideas.net\/password_leak_checker\" title=\"Password Leak Checker\">Password Leak Checker<\/a> uses k-anonymity, which means only the first 5 characters of a hash of the password are sent, so the full password never leaves your device. Have I Been Pwned separates an email breach search from its Pwned Passwords search. A match means that password has appeared in a breach. No match does not prove it is safe.<\/li>\n\n\n\n<li>If an account or password may have been exposed, change the affected credentials promptly.<\/li>\n\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">You are replacing these passwords because of a reuse pattern, not because of a schedule. NIST advises against routine changes without a reason. The free <a href=\"https:\/\/passwordideas.net\/downloads\/password-safety-checklist\" title=\"Password Safety Checklist (PDF)\">Password Safety Checklist<\/a> gives you a printable list of ten actions to track your progress.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"developer-note-how-should-a-login-system-treat-service-names-6\">Developer note: how should a login system treat service names?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This section is for IT and web development beginners. If you build a sign-in form, NIST SP 800-63B Revision 4 expects the verifier to check proposed passwords against a blocklist that includes context-specific words such as your service name. The check applies to the entire proposed password, so do not reject a password only because a word appears inside it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Store only hashes made with a slow algorithm such as bcrypt, never the passwords themselves. The <a href=\"https:\/\/passwordideas.net\/password_hash_generator\" title=\"Password Hash Generator\">Password Hash Generator<\/a> can create bcrypt hashes and verify matches in your browser. It is useful for learning and testing, not a substitute for a properly built storage layer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"faq-1\">Is a strong base enough?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A strong base protects well while nobody knows it. The weakness is the shared point of failure: if one full password is exposed, the base and your pattern may be inferred. CISA recommends a different password for each account instead.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"faq-2\">Does a different suffix count as unique?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It counts as a different string, but not as an independent secret. Because the site name is public, the suffix adds little secrecy once the rule is known. A separately generated random password does not depend on any other account.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"faq-3\">What if I have already used this method?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Do not panic. Replace the passwords on email and financial accounts first, then the rest, using new generated passwords that do not contain the old base. Turn on multifactor authentication and keep the new passwords in a reputable password manager.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"faq-4\">Is it ever wrong to have a site name in a password?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A random password may contain any characters by chance. The problem is building passwords from a rule that uses the site name, because it is a predictable guess. NIST lists service names as expected content for blocklists.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"faq-5\">Does two-factor authentication fix this?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It helps a lot, because a password alone is no longer enough to sign in. It does not replace unique passwords, though. Use both, and prefer passkeys where a service supports them.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"faq-6\">Should I change all my passwords on a schedule?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. NIST advises against routine changes without evidence of compromise. Here you have a reason, a predictable shared pattern, so replace those passwords once and then leave them alone unless a breach or suspected exposure occurs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"faq-7\">Should I use a passkey instead?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Where a service supports them, passkeys are a good option. The FIDO Alliance describes them as unique and bound to the service&#8217;s domain. For services without passkeys, use a generated unique password and multifactor authentication.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"next-steps\">Next steps<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Adding website name to password for each account is a tidy habit, but it ties every login to one shared base. The safer recap is simple: generate a long, random password for every account, store them in a reputable password manager, turn on multifactor authentication, check for exposure, and fix email first. Open the <a href=\"https:\/\/passwordideas.net\/\" title=\"Secure Password Generator\">Secure Password Generator<\/a> and create a fresh password for your most important account today.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Related tools and resources on Password Ideas:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/passwordideas.net\/password_leak_checker\">Password Leak Checker<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/passwordideas.net\/blog\/high-password-entropy-but-weak-strength-score\/\">High Password Entropy but Weak Strength Score: Why It Happens<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/passwordideas.net\/password-ideas\/email\">Email<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/passwordideas.net\/downloads\/password-safety-checklist\">Password Safety Checklist (PDF)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/passwordideas.net\/bulk_password_generator\">Bulk Password Generator<\/a><\/li>\n\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"sources\">Sources and further reading<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/pages.nist.gov\/800-63-4\/sp800-63b.html\" target=\"_blank\" rel=\"noopener\">NIST Special Publication 800-63B<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.cisa.gov\/topics\/cybersecurity-best-practices\" target=\"_blank\" rel=\"noopener\">Cybersecurity Best Practices | Cybersecurity and Infrastructure Security Agency CISA<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/pages.nist.gov\/800-63-4\/\" target=\"_blank\" rel=\"noopener\">NIST SP 800-63 Digital Identity Guidelines<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/haveibeenpwned.com\/FAQs?lang=en\" target=\"_blank\" rel=\"noopener\">Have I Been Pwned: Frequently Asked Questions<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Credential_Stuffing_Prevention_Cheat_Sheet.html\" target=\"_blank\" rel=\"noopener\">Credential Stuffing Prevention &#8211; OWASP Cheat Sheet Series<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/collection\/using-online-services-safely\/securing-your-users-accounts\" target=\"_blank\" rel=\"noopener\">Using online services safely | Securing your users\u2019 accounts | National Cyber Security Centre<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/fidoalliance.org\/specifications\/\" target=\"_blank\" rel=\"noopener\">FIDO User Authentication Specifications | FIDO Alliance<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/blog-post\/the-logic-behind-three-random-words\" target=\"_blank\" rel=\"noopener\">The logic behind three random words | National Cyber Security Centre<\/a><\/li>\n\n\n<\/ul>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Adding a website name to a shared password for each account looks clever but keeps one weak point. Learn the risk and the safer fix.<\/p>\n","protected":false},"author":1,"featured_media":52,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[28,31,30,29,26,27],"class_list":["post-50","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-password-habits-and-reuse","tag-credential-stuffing","tag-nist-password-guidance","tag-password-managers","tag-password-patterns","tag-password-reuse","tag-unique-passwords"],"_links":{"self":[{"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/posts\/50","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/comments?post=50"}],"version-history":[{"count":4,"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/posts\/50\/revisions"}],"predecessor-version":[{"id":59,"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/posts\/50\/revisions\/59"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/media\/52"}],"wp:attachment":[{"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/media?parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/categories?post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/passwordideas.net\/blog\/wp-json\/wp\/v2\/tags?post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}