The Most Common Password Mistakes
Most hijacked accounts are not “hacked” in any sophisticated sense — they fall to a handful of predictable mistakes. These six cover the vast majority of real-world account takeovers.
1. Reusing the same password everywhere
When any one site leaks, your email-and-password combination is tried against every major service within hours — this is credential stuffing, and it is the single most common way accounts are taken over. One password, one account. No exceptions.
2. Building passwords from personal details
Names, birthdays, pets and favourite teams appear in your public profiles, and cracking tools feed on exactly that. A password an attacker can research is not a secret.
3. Keyboard patterns and the classics
123456, qwerty, iloveyou and their cousins top every leaked-password list, year after year. Attackers try those lists first — such a password survives seconds.
4. Trusting l33t substitutions
P@ssw0rd! is not meaningfully stronger than password: every cracking tool applies the standard substitutions (a→@, o→0, an appended !) automatically. Real strength comes from length and randomness, not decoration.
5. Keeping passwords short
Below 12 characters, even a truly random password falls quickly to an offline attack — length multiplies difficulty in a way symbols cannot. See our password length guide for the actual numbers.
6. Storing passwords in plain text
A notes app, a spreadsheet or an email draft called “passwords” hands everything over in a single incident. Use a password manager: the vault is encrypted, and one strong master passphrase is all you memorise.
Security Guides
How Long Should a Password Be?
How password length affects cracking time — real numbers per length and character set, plus recommendations for accounts, email and master passwords.
The Most Common Password Mistakes
Six password mistakes attackers exploit every day — reuse, personal details, keyboard patterns, l33t substitutions, short passwords and unsafe storage — and what to do instead.
Two-Factor Authentication (2FA): What It Is and Why It Matters
How two-factor authentication works, which method to choose — security key, authenticator app or SMS — and which major services support it.
Do You Need a Password Manager?
Why a password manager is the only realistic way to keep a unique, random password for every account — and how to protect the vault itself.
Data Breaches: What Happens to Your Passwords When a Service Is Hacked
Breach, scrape or credential stuffing? What each incident type means for your passwords, documented incidents at major services, and what to do when it happens.