Why bad passwords still dominate
Every year, breach databases publish the same top-ten list. “123456”, “password”, “qwerty” dominate year after year, despite years of warnings. The reason is not ignorance — it’s friction. Strong passwords are hard to remember. The mistakes below are all attempts to reduce that friction, but each one trades security for convenience in a way that attackers have long since exploited.
Before working through the list, open the Password Strength Checker and paste in any password you currently use for something important. It will show you exactly what score it gets and which classes are missing. If the result is uncomfortable, you’re in the right place.
Mistake 1: Using a single word from the dictionary
A dictionary attack runs through every common word — in English, Hindi, Spanish, and a dozen other languages — in seconds. Software like Hashcat can test 10 billion guesses per second against leaked password hashes. A single English word like “sunshine” is cracked in under a millisecond.
Fix: Use a phrase of four or more unrelated words strung together (“correct horse battery staple”), or let a password generator produce something random.
Mistake 2: Reusing the same password across sites
This is the amplifier. A strong password used on 20 sites gets compromised on all 20 the moment any one of those sites leaks its user database. And breaches happen constantly — over 6 billion credential pairs are in circulation on the dark web.
Fix: Every account gets its own password. Use a password manager — it is the only practical way to maintain unique passwords at scale.
Mistake 3: Leet-speak substitutions
“P@ssw0rd”, “s3cur1ty”, “l3tm31n” — character-for-character replacements of letters with symbols or digits. Attackers know every common substitution. Their dictionaries include them by default. Running these through the Password Strength Checker shows why: the crack-time estimate is the same order of magnitude as the base word because the substitution patterns are entirely predictable.
Fix: If you want symbols and digits, add them randomly, not as replacements for letters in recognisable words.
Mistake 4: Using personal information
Name of your dog, child, or partner. Birth year. Hometown. Favourite team. Mothers’ maiden name. Attackers performing targeted attacks pull all of this from social media before they try a single guess. Even without targeting you specifically, “Mumbai2001” or “Sachin#18” are in wordlists that combine common names, cities, and dates.
Fix: Keep passwords entirely unrelated to your life. A random generator eliminates the bias.
Mistake 5: Keyboard walks and patterns
“qwerty”, “1qaz2wsx”, “zxcvbn”, “asdfghjkl” — these follow obvious keyboard paths. Every serious cracking tool has these patterns built in. Likewise, “111111”, “123456789”, and “aaaaaa” are cracked immediately.
Fix: If you need a memorable structure, use a passphrase of genuinely random words rather than a keyboard pattern.
Mistake 6: Short passwords
A six-character password using all character classes (upper, lower, digits, symbols) has about 40 bits of entropy. Against an offline attacker with a GPU rig running Hashcat, that falls in minutes. Password length is the single biggest lever: going from 10 to 16 characters roughly multiplies the search space by a factor of a million even with the same character set.
Fix: Set a minimum length of 16 characters for important accounts. Passphrases make long passwords memorisable.
Mistake 7: Adding a number to the end
“Password1”, “soccer2024”, “India123” — appending one or two digits to a word is so common that every dictionary-attack ruleset applies digit-appending transforms automatically. Adding ”!” to the end (“Password1!”) is equally predictable.
Fix: If you want complexity at the ends, generate it randomly rather than following the predictable “word + numbers” template.
Mistake 8: Using the same base word with minor variations
“Summer2024”, “Summer2025”, “Summer2024!” — sequential variations let an attacker who knows one password guess the rest. This pattern also defeats forced-rotation policies, because users just increment the year.
Fix: Each password should be completely independent of the others, not a rotation of the same root word.
Mistake 9: Ignoring the “Have I Been Pwned” check
Billions of credentials from past breaches are publicly searchable. A password that is otherwise strong but has appeared in a breach is worth nothing — attack tools start with these known passwords. The Password Strength Checker can flag basic structural weaknesses, and a separate HIBP check can tell you whether the exact password has been seen before.
Fix: Check your passwords against HIBP at haveibeenpwned.com/passwords. Replace any password that appears.
Mistake 10: Writing passwords on sticky notes or in plain-text files
A password stored in a spreadsheet called “passwords.xlsx” on your desktop, or on a Post-it note under your keyboard, is not a password at all for any attacker with physical or file-system access. This even applies to browser-saved passwords without a master password — malware can extract them from the browser profile.
Fix: Use a password manager with a strong master password and two-factor authentication. The master password is the only one you need to memorise; the rest are generated and stored securely.
How to audit your passwords today
- Open the Password Strength Checker and test your most important passwords.
- Look for any that score below “Strong”. Those need replacing immediately.
- Identify which of the mistakes above each weak password makes.
- Install a password manager (Bitwarden, 1Password, Dashlane) and migrate all accounts.
- Enable two-factor authentication (2FA) on every account that supports it. Even a weak password is protected by 2FA.
Strong passwords are no longer something you need to hold in your head. With a password manager, you only need one strong passphrase — and the manager handles the rest.