10 Common Password Mistakes and How to Fix Them

Most account takeovers exploit the same handful of habits. Fixing them takes less time than most people expect.

The mistakes

1. Reusing passwords. One breach unlocks many accounts. *Fix:* a unique password for every site, stored in a password manager.
2. Short passwords. Eight characters is no longer enough. *Fix:* 16 or more random characters.
3. Personal information. Names, birthdays, pets and teams are easy to research. *Fix:* use a random password generator.
4. Predictable substitutions. "P@ssw0rd" fools nobody. *Fix:* randomness, not clever tweaks.
5. Keyboard patterns. "qwerty", "1qaz2wsx" and "zxcvbn" are in every cracking list. *Fix:* generated passwords.
6. Seasonal passwords. "Winter2026!" is one of the first guesses in password-spraying attacks. *Fix:* avoid dates and seasons entirely.
7. Honest security answers. Your mother's maiden name may be public. *Fix:* treat security questions as extra passwords and store random answers in your manager.
8. Saving passwords in notes or spreadsheets. These files are easily synced, shared or stolen. *Fix:* an encrypted password manager.
9. Sharing passwords by email or chat. Messages are kept for years. *Fix:* the sharing feature in a password manager.
10. Skipping two-factor authentication. A password alone is a single point of failure. *Fix:* turn on 2FA or passkeys for email, banking and work accounts.

Start with three accounts

You do not need to fix everything today. Begin with your email, your password manager and your bank. Securing those three blocks most attack paths, because email resets everything else.

Frequently asked questions

What are some strong password examples?

Strong password examples look like random strings, such as a 20-character mix of letters, numbers and symbols, or a passphrase of six random words. Never use an example published online, including ours; generate your own.

What are the main password dos and don'ts?

Password dos and don'ts: do use long, unique, generated passwords, a password manager and 2FA. Don't reuse passwords, use personal information, write them in shared notes or answer security questions honestly. These password tips and password best practices block most attacks.

Should I use fake security answers?

Yes. Fake security answers are safer than real ones, because real answers can often be found online. Generate random answers and store them in your password manager.