Most people think a weak password is one that's too short. In practice, weak passwords share several distinct patterns — and attackers' tools are specifically designed to exploit each one.
How Passwords Are Cracked
Understanding the attack methods explains why certain patterns are weak:
Dictionary attacks: tools test enormous lists of common passwords, words, names and phrases. The RockYou breach alone exposed 14 million real passwords, and tools use these as the first thing they try.
Rule-based attacks: built on dictionaries but apply known patterns — capitalising the first letter, adding numbers at the end, substituting letters with symbols (a→@, e→3, i→!). P@ssw0rd is tested automatically.
Brute force: trying every possible combination up to a length limit. At modern speeds, an 8-character password can be brute-forced offline in hours to days.
Credential stuffing: using passwords exposed from one site's breach to log in to other sites. If you reuse passwords, one breach exposes many accounts.
Patterns That Make Passwords Weak
| Pattern | Why it fails |
|---|---|
| Dictionary words | First thing dictionary attacks try |
| Personal info (name, birth date, pet) | Guessable; often public on social media |
Password, Admin, Welcome, Login | In every tool's list |
| Short passwords (8 characters or less) | Brute-forceable in reasonable time |
| Letter-for-symbol substitutions | Tools know all common substitutions |
Repetition (aaaaaa, 123123) | Trivially tested |
Keyboard patterns (qwerty, asdf1234) | In every list |
| Reused passwords | One breach = all accounts at risk |
The "Complexity" Trap
Many systems require capitals, numbers and symbols in an 8-character password. This produces passwords like Welcome1! which are simultaneously annoying to type and easy to crack. A 15-character lowercase phrase is safer and easier to remember.
What to Do If Your Passwords Have These Patterns
- Change them — starting with the most important accounts (email, banking, primary social media).
- Generate strong ones with Password Generator.
- Check your strength with Password Strength Checker.
- Use a password manager so unique strong passwords per site become effortless.
For the positive side — how to make strong passwords — see how to create a strong password you can remember.
After a Data Breach
If you hear that a service you use has been breached, change your password for that service immediately — and change it on any other service where you used the same password. Use HaveIBeenPwned.com to check whether your email address has appeared in known breach databases. Enable 2FA on the affected account and any accounts sharing that password. The damage from a breach grows proportionally with how many services share the compromised password — which is the most concrete argument for unique passwords everywhere.
