Turning password into p@ssw0rd is one of the most common password tricks. It looks scrambled, and it ticks the "use a symbol and a number" box that many sites ask for. Unfortunately, it barely slows anyone down.
Most people make the same few swaps, sometimes called leetspeak:
a becomes @ or 4e becomes 3i or l becomes 1 or !o becomes 0s becomes $ or 5Add a capital letter at the start and an ! at the end, and that covers most "complex" passwords.
Password-cracking tools such as Hashcat and John the Ripper don't just try a list of words. They apply rules to each word: swap the usual letters for symbols, capitalize the first letter, add a year or an ! at the end. Because everyone makes the same swaps, a few rules cover most of them. If the word underneath is easy to guess, the password is still easy to guess.
For years, sites required a capital letter, a number and a symbol, hoping to make passwords stronger. In practice, people met the rules with the same predictable swaps. NIST, the US standards body, now advises sites not to force these character mixes. It tells them to allow long passwords and check new ones against lists of common and leaked passwords instead.
Guess The Password is a free password guessing game built on habits like this one. Each level gives you a fictional person's profile, chats and posts, and you crack their password from the clues they left. Every person and password in it is made up. There's also the Daily Cipher, a new password to crack every day.
Seeing how quickly a "personal" password falls is the fastest way to stop using one.
Play free in your browserTry today's Daily Cipher