Despite years of security awareness campaigns, the same password mistakes appear in breach after breach. Here are the 10 most common — and exactly how to fix each one.
1. Reusing the Same Password
The single most dangerous password habit. When any site you use is breached, attackers immediately try your credentials on hundreds of other sites (credential stuffing). Fix: Every account gets a unique password. Use a password manager.
2. Using Personal Information
Birthdays, names, pet names, phone numbers, and addresses are the first things attackers try — especially with targeted attacks. Social media makes this information easy to find. Fix: Generate random passwords with no personal connection.
3. Short Passwords
8-character passwords can be brute-forced in hours with modern hardware. Fix: Use 16+ characters. Our generator defaults to 16 — increase it for sensitive accounts.
4. Common Substitutions (Leet Speak)
"P@ssw0rd" and "S3cur1ty!" look complex but are among the first patterns cracking tools test. Fix: True randomness, not human-invented patterns.
5. Writing Passwords on Sticky Notes
Physical notes on monitors or desks are visible to anyone in your office or home. Fix: Use a password manager with a strong master password.
6. Not Using Two-Factor Authentication
Even a perfect password offers limited protection if it leaks. 2FA means an attacker also needs your physical device. Fix: Enable 2FA on every account that supports it, preferably via authenticator app.
7. Using the Same Password Pattern
Creating "Netflix2024!", "Amazon2024!", "Gmail2024!" is not using unique passwords — attackers who crack one can guess the rest. Fix: Truly random, unrelated passwords for each service.
8. Ignoring Password Manager Security Alerts
Most password managers flag weak, reused, or breached passwords in your vault. Many users ignore these warnings for months. Fix: Review your password health report regularly and update flagged passwords.
9. Not Updating Compromised Passwords
After a breach notification email, many users plan to change their password "later" and forget. Fix: Change compromised passwords within 24 hours of notification. Use our Email Breach Checker proactively.
10. Choosing Security Questions With Guessable Answers
Your mother's maiden name, hometown, and first pet's name are often findable on social media or public records. Fix: Treat security question answers as passwords — use random strings stored in your password manager.
Related: What Makes a Password Strong? → · Best Free Password Managers →