1. The "Capitalize the First, Symbol at the End" Pattern
Because many websites force users to include an uppercase letter and a symbol, a massive percentage of users follow the exact same path of least resistance: they capitalize the first letter of a word, and add an exclamation point or a "1!" to the very end. (e.g., Monkey1!, Summer2024!).
Why it's bad: Hackers know this. Their password cracking software specifically takes dictionary words and automatically applies these exact transformations. This "complexity" provides zero actual security.
2. Predictable Character Substitutions (Leetspeak)
Replacing an 'a' with an '@', an 'E' with a '3', or an 'S' with a '$'. For example, turning password into P@$$w0rd.
Why it's bad: This might have tricked a human looking over your shoulder in 1998, but it does not trick computers. Automated cracking dictionaries are pre-programmed with all standard character substitutions. To an algorithm, P@$$w0rd is exactly the same as password.
3. Keyboard Walks
Typing adjacent keys on the keyboard to create a string that looks random but is physically easy to type. Examples include qwertyuiop, asdfghjkl, or 123456789.
Why it's bad: These sequences represent zero actual entropy. They are hardcoded into the top 10 list of every password cracking dictionary in existence.
4. Using Personal Information
Incorporating your birth year, your spouse's name, your pet's name, your favorite sports team, or the street you grew up on.
Why it's bad: This information is almost certainly publicly available on your social media profiles. Targeted attacks (called spear-phishing or social engineering) start by scraping your Facebook and Instagram to build a custom dictionary specifically tailored to crack your accounts.
5. Reusing the Same Password Everywhere
Having one incredibly strong, 30-character password and using it for your bank, your email, and a random gaming forum.
Why it's bad: This is the number one cause of account compromise today. When the random gaming forum gets hacked, the attackers extract your email and password. They then test that combination on every major banking and email provider (a technique called credential stuffing). One breach compromises your entire digital identity.
6. The "Root Password + Suffix" Strategy
Trying to avoid password reuse by using a base password and adding the name of the website to the end. For example: MyP@sswordFacebook, MyP@sswordGmail.
Why it's bad: If an attacker compromises your Facebook password, they can immediately deduce your "system." They will simply strip "Facebook" off the end, add "Gmail", and access your email account.
7. Trusting Your Memory Instead of a Manager
Attempting to invent and remember 100 different, complex passwords entirely in your brain, or writing them down in an unencrypted Excel spreadsheet called "passwords.xlsx".
Why it's bad: You will inevitably fail, become frustrated, and fall back into one of the bad habits listed above (usually reuse). The only reliable way to maintain secure, unique, 20+ character passwords for every single website is to use a dedicated Password Manager.
Are You Making These Mistakes?
Our client-side tool specifically scans for these common patterns, including repeated sequences and keyboard walks. Test your password locally now.
Check Password Strength