The 10 Most Common Password Mistakes and How to Fix Them

The password advice most people get is a list of things not to do. Don't use your birthday. Don't reuse. Don't write it down. That's fine as far as it goes, but it leaves you staring at a login box with no idea what to type.

Here are the ten mistakes that cause the most trouble, roughly in the order they cost people the most, along with the fix for each. Most of the fixes take a few minutes. One takes about thirty seconds and protects everything else.

Mistake 1: Reusing a password because it's already in your head

Reuse is the mistake that turns one small breach into a very bad week. When a forum or shopping site leaks, attackers take those email-and-password pairs and try them everywhere else: your email, your bank, your work account. They don't have to be clever. They just have to be patient.

The fix is one password per account, which sounds impossible until you stop trying to remember them. A password manager remembers; you remember one. Start with your email address, because it's the reset key to everything else. Whoever controls your inbox can request a password reset on almost any account you own.

Mistake 2: The one-character tweak

Changing Password1 to Password2, or adding the site name to the end, doesn't create a new password. It creates a variation, and cracking tools are built to try variations. If one version turns up in a leak, the others get tested within minutes.

Make each password genuinely unrelated to the last. If you're typing them by hand, change the structure, not the number.

Mistakes 3 and 4: Passwords built from your life and your keyboard

Mistake 3: Personal details

A birthday, a child's name, a street, a team, a pet. These are the first things a stranger tries after a quick look at your public profiles, and wedding dates and jersey numbers are especially easy to find.

Mistake 4: Keyboard walks and single words

Anything you can find in a word list is fair game for automated tools. The usual offenders:

• Names and dates connected to you or your family
• Keyboard patterns such as qwerty, asdfgh, or 1qaz2wsx
• Single words with a capital letter and a symbol tacked on: Summer2024!
• Phrases from films, songs, or sports teams you post about

The fix here is length over cleverness. Four unrelated words joined together — copper-basin-kite-vanish — is long, memorable, and far harder to crack than a short scramble of symbols you'll forget by Thursday. For your most important accounts, let the manager generate sixteen or more random characters and never look at them again.

Mistakes 5 and 6: Storing and sending passwords carelessly

Mistake 5: The sticky note and the spreadsheet

A note on the monitor, a page at the back of a planner, a file called passwords.xlsx, a screenshot in your camera roll. Each of these turns a strong password into an object anyone nearby can copy.

Paper isn't automatically wrong. A written list in a locked drawer at home is a reasonable backup for a master password, and it can't be hacked remotely. Placement is the problem. A sticky note on a laptop that travels to cafés and meetings is a different risk entirely.

Put your logins in an encrypted password manager. If you prefer paper for the single password that opens it, seal that one and keep it somewhere that stays home.

Mistake 6: Sending passwords over email or chat

Messages are stored, backed up, and often searchable years later. Typing a password into a chat also puts it in a thread other people may forward.

Most password managers let you share one item with another person without revealing the password, and you can revoke it later. For shared household or work accounts, separate logins with their own permissions are better still — you can remove one person without changing the password for everyone.

Mistakes 7 and 8: Ignoring breaches and trusting the password alone

Mistake 7: Doing nothing after a breach notice

When a service you use announces a breach, the clock starts. Change that password immediately, then change it anywhere you reused it — the moment you'll be glad you stopped reusing. If your email account was involved, secure that first, then look through its settings for forwarding rules or filters you didn't create.

If money is involved — a bank, a payment app, a card — contact the provider directly. A password change won't reverse a fraudulent transaction, and your bank's fraud team is the right place to start.

Mistake 8: Treating the password as the only lock

A strong password is the first lock, not the whole door. Two-factor authentication — a code from an app, a hardware key, or a prompt on your phone — means a stolen password alone isn't enough. Turn it on for email, banking, and anything that stores payment details or personal documents. Where a service offers passkeys, they remove the password from the process entirely, and that's worth taking.

Mistakes 9 and 10: Weak points around the vault

Mistake 9: Saved logins on a shared or borrowed device

Browsers offer to remember passwords, which is convenient on your own computer and risky on a family laptop, a hotel business center, or a machine you're about to sell. Before you hand a device to someone else, sign out of your accounts and clear the saved passwords. Set your phone and computer to lock with a PIN, passcode, or biometrics; a saved password behind an unlocked screen is just an open door.

Mistake 10: A weak master password on an otherwise good setup

If every

Photo: Maria Tyutina / Pexels