Most passwords aren't cracked by a genius typing fast in a dark room. They're guessed. People build passwords out of the things that matter to them, and those are often the same things they talk about in chats, post online and put in their bio. Someone who knows where to look can work out a lot of passwords with a bit of patience and a few good guesses.
Here are the seven habits that make a password easy to guess, and what to do instead.
The name of a dog, a child or a partner is one of the most common starting points for a personal password. It's easy to remember because it means something to you. It's also easy to find: pets and family turn up in photos, captions, comments and birthday posts.
A name is often followed by a number, and the number is usually a date: a birth year, a wedding day, the year a child was born or the year someone graduated. Dates feel private, but many of them sit in plain sight on social profiles and in "happy birthday" messages.
Turning password into p@ssw0rd feels clever, but the swaps are so predictable that password-cracking tools try them automatically: a to @ or 4, o to 0, e to 3, s to $. If the word underneath is easy to guess, the symbols barely slow anyone down.
Sports teams, bands, games, TV shows and hobbies make popular passwords, especially when they're a big part of who you are. The more you talk about something, the more likely it is to be in your password, and the easier it is for someone else to spot.
When a site makes you change your password, the easy move is to bump the number at the end: Summer2024! becomes Summer2025!. Anyone who has seen one old password from a data breach can guess the next one in a few tries.
Passwords like 123456, qwerty and iloveyou top lists of leaked passwords year after year. Attackers try the most common passwords first, so these fall in seconds, however long they look.
This is the habit behind all the others. Collecting what someone has made public, from posts and profiles to comments and old forum accounts, is called open-source intelligence (OSINT). Each detail on its own seems harmless. Put together, a pet's name, a birthday post and a favorite team can be enough to guess a password.
Guess The Password is a free password guessing game built on these habits. Each level gives you a fictional person's profile, chats and posts, and you crack their password by spotting the pet, the date or the team they couldn't resist using. Every target and password is made up. There's also the Daily Cipher, a new password to crack every day, and each one ends with a note on why it was easy to guess.
Seeing how quickly a "personal" password falls is the fastest way to stop using one.
Play free in your browserTry today's Daily Cipher
New to the game? Read how to play.