15 Common Password Mistakes That Put You at Risk (And How to Fix Them)

What it looks like: You use "Fluffy2019!" for your email, Netflix, banking, and shopping accounts because it's easy to remember.

Why it's risky: When one site gets breached (and they do regularly), hackers immediately try your stolen password on hundreds of other popular sites. One compromised account becomes ten compromised accounts overnight.

Do this instead:

• Create a unique password for every single account
• Use a password manager to generate and store different passwords
• Prioritize unique passwords for financial and email accounts first
• Consider using a simple pattern system if you're not ready for a password manager yet

What it looks like: Using passwords like "password123," "qwerty," "123456," or "welcome1" because they meet basic requirements.

Why it's risky: These passwords appear on every hacker's "try first" list. Automated tools can crack simple passwords in seconds, not hours or days.

Do this instead:

• Aim for at least 12 characters with mixed letters, numbers, and symbols
• Use random combinations that don't follow predictable patterns
• Try passphrases with random words like "Horse$Battery*Staple&Moon"
• Avoid dictionary words or keyboard patterns

What it looks like: Using your birthday, pet's name, street address, or family member's name in passwords like "Buddy2018" or "Main_Street_42."

Why it's risky: Social media makes personal information easy to find. Hackers can guess these passwords by looking at your Facebook profile or public records.

Do this instead:

• Avoid any information that appears in your social media profiles
• Don't use names, dates, addresses, or phone numbers
• Skip obvious substitutions like @ for A or 3 for E
• Choose completely random elements that have no connection to your life

What it looks like: Starting with "Summer2023!" then changing to "Summer2024!" and eventually "Summer2025!" when sites force updates.

Why it's risky: If hackers crack one version, they can easily guess the others. This pattern gives them access to multiple accounts across different time periods.

Do this instead:

• Create completely new passwords when updating, not variations
• Use a password manager to generate fresh, random passwords
• Set unique passwords that don't follow any personal or date-based patterns
• Think of each password change as a fresh start

What it looks like: Only entering your username and password to log in, even when sites offer additional security options.

Why it's risky: Even strong passwords can be stolen through data breaches or phishing attacks. Without two-factor authentication (2FA), a stolen password gives hackers complete access.

Do this instead:

• Enable 2FA on all important accounts (email, banking, social media)
• Use an authenticator app like Google Authenticator or Authy instead of SMS when possible
• Set up backup codes and store them securely
• Start with your most critical accounts and work your way down

What it looks like: Trying to remember dozens of passwords in your head or writing them down in notebooks and sticky notes.

Why it's risky: Human memory isn't designed for managing multiple complex passwords. This leads to reusing simple passwords or storing them insecurely.

Do this instead:

• Choose a reputable password manager and start with your most important accounts
• Let it generate strong, unique passwords for each site
• Use the browser extension to automatically fill passwords
• Only remember one master password that protects everything else

What it looks like: Keeping passwords in Notes apps, email drafts, Excel spreadsheets, or written on sticky notes around your desk.

Why it's risky: These storage methods aren't encrypted. Anyone with access to your devices, email, or workspace can see all your passwords in plain text.

Do this instead:

• Move all passwords to an encrypted password manager
• Delete password lists from Notes, emails, and documents
• Remove physical notes and papers with password information
• If you must write passwords down temporarily, destroy the paper after entering them in a password manager

What it looks like: Texting passwords to family members, emailing login details to coworkers, or shouting WiFi passwords across the room.

Why it's risky: Text messages and emails aren't encrypted, creating a permanent record that could be intercepted. Sharing passwords also makes it impossible to track who has access.

Do this instead:

• Use your password manager's secure sharing features
• Share accounts through family plans instead of sharing passwords
• Create temporary guest accounts when possible
• Use encrypted messaging apps for sensitive information if you must share

What it looks like: Deleting emails about data breaches without reading them or continuing to use the same password after being notified of a compromise.

Why it's risky: Breached passwords often end up for sale on the dark web. Criminals buy these lists and try the passwords on other sites.

Do this instead:

• Read breach notifications carefully and take recommended actions immediately
• Change passwords on the affected site and any other sites using the same password
• Check if your email appears in known breaches using reputable breach-checking services
• Monitor your accounts for suspicious activity after breaches

What it looks like: Clicking links in suspicious emails and entering your password on fake login pages that look like real sites.

Why it's risky: Phishing sites steal your credentials the moment you enter them. Even strong passwords become useless when you hand them directly to criminals.

Do this instead:

• Always type website URLs directly into your browser instead of clicking email links
• Check the URL carefully before entering passwords—look for misspellings or wrong domains
• Use your password manager as a safeguard—it won't autofill on fake sites
• When in doubt, navigate to the site independently and log in normally

What it looks like: Answering security questions with real, easily-guessed information like your actual mother's maiden name or the name of your first pet.

Why it's risky: Security questions often use information that's publicly available or easy to guess, essentially creating a backdoor that bypasses your main password.

Do this instead:

• Treat security questions like additional passwords—make up random answers
• Store your made-up answers in your password manager
• Use the same creativity you'd use for passwords: mix letters, numbers, and symbols
• Never use real personal information that could be researched

What it looks like: Letting the library computer remember your password or staying logged in on a friend's laptop after checking your email.

Why it's risky: The next person using that device can access your accounts. Even trusted friends might accidentally access your information.

Do this instead:

• Never save passwords on devices you don't own
• Always log out completely when using shared or public computers
• Use private browsing mode on devices that aren't yours
• Consider using your phone's hotspot instead of public computers for sensitive tasks

What it looks like: Using text message codes as your only second factor, especially for important accounts like banking or email.

Why it's risky: SMS messages can be intercepted or redirected through SIM swapping attacks. Phone-based codes are the weakest form of two-factor authentication.

Do this instead:

• Use authenticator apps instead of SMS whenever possible
• Set up multiple backup methods for important accounts
• Consider hardware security keys for your most critical accounts
• Keep SMS as a backup option, not your primary method

What it looks like: Continuing to use traditional passwords on sites that offer passkey options, like Apple, Google, or Microsoft accounts.

Why it's risky: You're missing out on the most secure authentication method available. Passkeys can't be phished, breached, or forgotten like traditional passwords.

Do this instead:

• Set up passkeys on sites that support them (they work with your device's built-in security)
• Use passkeys as your primary login method when available
• Keep traditional passwords as backups while passkey adoption grows
• Try passkeys on less critical accounts first to get comfortable with them

What it looks like: No backup codes saved, no recovery methods set up, and no plan for what happens if you lose access to your password manager or 2FA device.

Why it's risky: Losing your phone or forgetting your master password could lock you out of all your accounts permanently.

Do this instead:

• Save backup codes for 2FA in a secure location separate from your phone
• Set up multiple recovery methods for your password manager
• Keep your recovery email and phone number up to date
• Document your security setup in a secure place trusted family can access in emergencies