There’s a line in security that gets repeated because it’s true: hackers don’t break in, they log in. In my years working in IT security, the overwhelming majority of the genuinely damaging incidents I’ve seen didn’t involve a clever exploit. They involved a perfectly ordinary password doing a perfectly predictable thing. Below are the ten habits I see cause the most damage, each paired with how the attack actually unfolds — because once you see the mechanism, the fix stops feeling like a rule and starts feeling obvious.

1. Reusing the same password everywhere

This is the one that does the most damage by a distance. Here’s the chain I’ve watched play out: a low-stakes site — a forum, an old shop, a hobby service — gets breached. Within hours, attackers take those leaked email-and-password pairs and run credential stuffing: automated scripts that try the same combination against Gmail, banking, Amazon, everything. If you reused, one careless forum has just handed over your email. The fix is the only one that scales: a unique password per site, which in practice means a password manager.

2. The “base word plus a tweak” system

People who know not to reuse often invent a system instead: Tiger!Amazon, Tiger!Bank, Tiger!Gmail. It feels clever. It isn’t. The moment one variant appears in a leak, an attacker can see the pattern and script every obvious permutation in seconds. A system a human can remember is a system a machine can guess.

3. Predictable character substitutions

P@ssw0rd, B0st0n$, Adm1n! — swapping letters for lookalike symbols stops precisely nobody. Cracking dictionaries are built to check “leet speak” substitutions before the plain words. You’re not adding security; you’re adding the illusion of it, which is worse because it breeds confidence.

4. Seasonal and sequential rotations

This one is manufactured by bad policy. Force people to change their password every ninety days and you don’t get ten unique strong passwords a year — you get Spring2026!, Summer2026!, Autumn2026!. It’s a pattern you’ll find across whole departments wherever the policy persists. Attackers know the calendar too, and will happily guess next quarter’s variant. (Modern guidance, including NIST’s, now says stop forcing arbitrary rotation for exactly this reason.)

5. Keyboard walks

qwertyuiop, asdfghjkl, 1qaz2wsx feel random because your fingers travel a tidy path. But that path is physical and finite, and attackers have databases mapping every keyboard walk across multiple layouts. Geometry is not randomness.

6. Building passwords from personal information

Pet names, birth years, your team, your town. All of it is sitting on your public social media, which makes it raw material for a targeted attack. The friendlier and more memorable your password feels, the more likely it’s assembled from facts a stranger can look up in ten minutes.

7. Storing passwords in plain text

The sticky-note-on-the-monitor cliché is alive and well — it’s just digital now. A note titled “Passwords,” an unsaved email draft, a shared document of admin logins “just for the team.” That kind of shared note is exactly what turns one compromised account into a full house. If one device or account falls, plain-text storage hands over everything at once. A manager encrypts the lot behind one key instead.

8. Ignoring breach alerts

When a company announces a breach, the instinct is to assume you’re too small to matter and deal with it later. Attackers move faster than your good intentions — leaked credentials are often tested within hours of the database changing hands. “Later” is frequently after the damage. Change the affected password immediately, and anywhere you reused it (see mistake 1). My breach-recovery playbook walks through the first hour in order.

9. Treating the password as the only lock

A password is your first line of defence, not your only one. Without two-factor authentication, a single leaked or phished password is game over. With it, that password often isn’t enough to get in. Not all second factors are equal, though — I rank them from weakest to strongest in the 2FA guide. The short version: app-based or hardware factors, not SMS where you can avoid it.

10. Trying to memorise everything

The root cause under most of the others. The human brain cannot securely hold 130 unique high-entropy strings, so when we insist on memorising, we fall back on reuse, patterns and tweaks — mistakes 1 through 4. The honest fix is to stop memorising. Keep one strong passphrase in your head and let software remember the rest. That single shift removes most of this list at a stroke.

The pattern under the pattern

Read those back and you’ll notice they share a root: humans reaching for something memorable, and attackers industrialising the predictability that “memorable” creates. You don’t beat that by trying harder to be clever — cleverness is exactly what the tools are tuned for. You beat it by moving the memory burden onto a manager, protecting the important accounts with strong 2FA, and keeping one good passphrase for yourself.

Curious whether your current password trips any of these wires? Run it through the PassGuard Check analyser — it flags predictable patterns and estimates how fast the password would fall. Everything happens locally in your browser; nothing you type is ever stored or sent.