Weak passwords are not random mistakes. They follow patterns, and attackers have catalogued them. This guide, part of our password basics series, shows the patterns to avoid. All examples are here to teach you, so never use them.
The patterns attackers try first
| Pattern | Examples | Why it fails |
|---|---|---|
| Most common passwords | 123456, password, qwerty | Top of every list |
| Keyboard walks | asdfgh, 1qaz2wsx | People's fingers are predictable |
| Names | Family, pets, partners | Easy to find on social media |
| Dates | Birthdays, anniversaries, years | Limited number of options |
| Words with a number | sunshine1, football99 | Standard dictionary rule |
| Letter swaps | P@ssw0rd, Tr0ub4dor | Tools apply these automatically |
| Site names | Facebook123 | Attackers add the site's name |
| Seasons and years | Summer2025! | Very common at workplaces |
| Repeats | aaaaaa, abcabc | Trivial for any tool |
Why these fall so quickly
Attackers do not start from aaaaaaa. They start with real passwords from past data breaches, and then apply common changes. Their tools try the likely things first, so a predictable password falls in a fraction of the time that its length suggests. See how hackers crack passwords.
Personal details are not secret
If your friends could guess it, so can a stranger with your social media profile. Avoid:
- Your name, username or email address.
- Children, pets and partners.
- Your birthday, or your phone number.
- Your street, school or favorite team.
How human habits betray us
Studies of leaked passwords reveal the same habits again and again:
- A capital letter at the start.
- Numbers or symbols at the end.
- A meaningful word in the middle.
- An old password with one change.
Quick self-test
Your password is probably weak if:
- It is shorter than 12 characters.
- It contains a word in any dictionary.
- It relates to you or your life.
- You have used it, or something like it, before.
- You chose it yourself, without dice or a generator.
What to do instead
Replace weak passwords with long random ones. Our guide on how to create a strong password shows how, and a password manager does the remembering. Do not try to fix a weak password by adding symbols. As our complexity guide explains, that adds very little.