Academy › Publishing › Domain and email
The password you can't reuse here
By the end you'll have two new passwords, generated and not reused anywhere else: one for email and one for your registrar panel.
By Yodai · Published on September 6, 2026 · Updated on October 12, 2026
What's the password for the panel where you bought your domain? If it's similar to your email password, or your bank password, or the one you've used everywhere for years, you have a problem that doesn't show up until it's too late.
A registrar account can be broken into like any other online account: by guessing the password, stealing it from a computer, catching it while you type it, or tricking it out of you, according to an ICANN guide on protecting domain accounts. There's one way in that doesn't need any of that: someone gets a password of yours from a site that has nothing to do with your business, a forum, a store, an app you don't even remember. They try that same password on your email and on the registrar's dashboard. If it matches on either one, they're already in.
Nobody has to target you on purpose. Criminals know a lot of people reuse the same password across accounts, so they try a stolen one on other accounts too, as the NCSC, the UK's cybersecurity center, explains. Nobody picks your business specifically: you get caught the same way anyone with the same habit would.
This lesson fixes that: two passwords, one for email and one for the registrar, and neither one repeated anywhere else in the business.
Why email and the registrar can't share anything
The registrar is the company you pay every year to keep yourdomain.com yours. Inside that panel there's a button that says "transfer" and another that says "change the nameservers." Anyone who gets in there can change those nameservers and send your visitors to theirs, leaving you without a website or email, or even keep your domain for themselves, as ICANN's own guide describes. Your website stops being where you left it, without you touching a thing.
Email is the other piece, and it matters more than it seems, because almost everything else depends on it. If someone gets into your email, they click "forgot my password" on the registrar, the bank, the payment processor, the Yodai dashboard. Email isn't just one account among many: it's the one that unlocks all the others. The ICANN guide points this out too: that's where the registrar sends its alerts and the messages to reset your registrar account password.
Think of a hair salon that manages its domain, its email, and its booking account with the same password it's used since opening day. The day that password leaks on some unrelated site, whoever has it doesn't need to guess anything else: they log into the email, request a password reset on the registrar, and the salon loses control of its site and its inbox. No technical failure was needed, just one password that worked everywhere.
That's why these two passwords stand alone. The registrar password doesn't work for email, the email password doesn't work for the registrar, and neither one shows up on the business's Instagram account, the old hosting account, the store's wifi, or the vendor spreadsheet. A password that lives in two places no longer protects either one.
Whoever steals a password tries it on other accounts too, like email or the registrar, not just the site where it leaked
How to set up both passwords today
- 1A password manager, not your memory
Install one: Bitwarden, 1Password, or whatever comes built into your browser if you don't have one yet. The password stops living in your head, so it can be long and mean nothing to you at all. - 2Generate it, don't make it up
Let the manager generate a random password of at least fifteen characters for your email, and a different one, also generated, for the registrar. Fifteen is the minimum the NIST guide, from the US standards institute, asks services to require when the password is the only thing protecting the account. A password you make up yourself usually follows a pattern, and a pattern can be guessed. - 3Change your email first
Log in to your email, set the generated password, and check the list of active sessions. Sign out of any you don't recognize before moving on to the next step. - 4Then change the registrar
With your email already secured, log in to the registrar's panel and change that password too. If your email were compromised, changing the registrar password first wouldn't do any good. - 5Track down the old password everywhere else
Go through which other business accounts used that same password, like hosting, social media, or your payment processor, and change it there too. Every account needs its own, no exceptions.
- Generates random strings that give away no pattern
- Stores a different password for every account with no memory work
- Many will alert you if one of your passwords turned up in a known breach
- Easy to remember without opening any app, but only if it's short and follows a pattern
- Anyone who knows one variation can guess the others in just a few tries
- Nothing warns you if it's already leaked somewhere else
Which one to pick: Use the manager. The only real reason to memorize anything is not having your phone on hand, and for that, it's enough to memorize the manager's own master password, not the password for every account.
Check what you've already got before calling the change done
Before you close out this lesson, check whether your email or password has already shown up in a known breach. There are online tools that check this with just your email, like haveibeenpwned.com, one of the ones the NCSC cites in its guide on data breaches, and antivirus programs and password managers often include a similar service. If your email turns up in a breach, the password you used on that leaked site is burned for good, even if you don't use it anymore: the NIST guide tells services to reject passwords pulled from past breaches.
Do the same with the password you just left behind: if it worked for your email, your registrar, and also your hosting provider's panel, that provider falls under the same review. The rule isn't just to change two passwords, it's to change every account that shared the one you now know was spread around where it shouldn't have been.
With these two passwords changed and saved in the manager, you've closed the one door in that doesn't depend on any technical flaw, just a habit. What's left is reviewing the other accounts that shared the old password, which won't happen in a day, but should happen this very week.
The next lesson tackles a different gap: which email to use to recover your registrar account, because that recovery email can't be the one hosted on your own domain.
- Your email and your registrar panel have different passwords, generated, not made up
- Neither one gets reused on any other business account
- Both are saved in a password manager, not in your memory or on a sticky note
- The email's active sessions were checked before the change was considered done
Cases to decide
Answer before opening each one. If one gives you trouble, go back to the section that explains it.
1. You change the registrar password but leave the email one as it was, because "that one's never been involved in anything." What's missing, and why does it matter?
You still need to change the email password. If someone gets into that inbox, they can request a recovery link from the registrar and get in anyway, so leaving the email with its old password cancels out the change you made at the registrar.
2. Your registrar password is the same one you used three years ago at an online store that's since closed. Can you keep using it if there was never a breach notice?
No. The absence of a notification doesn't mean there was no breach: Article 34 of the General Data Protection Regulation only requires the store to notify you when the breach is likely to pose a high risk to you. Change it anyway, since checking takes more effort than just generating a new one.
3. You memorize a long password and reuse it for your email too, since it's easier than opening the password manager every time. Is the convenience worth it here?
No. However long it is, if it's the same one on both accounts, a single breach compromises both at once. The password manager solves the convenience problem, not reuse.
With both passwords no longer reused, there's still the crack nobody checks: which email your account runs to when you click "forgot my password," and whether that email lives inside the very domain it's supposed to protect.
Sources
- A Registrant’s Guide to Protecting Domain Name Registration Accounts, SAC 044. Security and Stability Advisory Committee (SSAC), ICANN, 2010 (accessed October 2026).
- Recovering a hacked account. National Cyber Security Centre (NCSC), United Kingdom, 2018, revised 2022 (accessed October 2026).
- NIST Special Publication 800-63B. National Institute of Standards and Technology (NIST), United States, revision 4, 2025 (accessed October 2026).
- The Tangled Web of Password Reuse. Anupam Das, Joseph Bonneau, Matthew Caesar, Nikita Borisov, and XiaoFeng Wang, NDSS Symposium, 2014 (accessed October 2026).
- Data breaches: guidance for individuals and families. National Cyber Security Centre (NCSC), United Kingdom, 2021 (accessed October 2026).
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), article 34. Official Journal of the European Union, as published in the BOE, 2016 (accessed October 2026).
In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.
NextThe recovery email can't live inside the domain it's protecting