We all know we should use strong passwords. But when life gets busy, it’s easy to reuse the same one, keep it short, or pick something familiar.

That’s why a recent NordPass analysis is so eye-opening. By reviewing passwords exposed in data breaches and leaked databases, researchers were able to identify patterns across different age groups. The result is a simple takeaway: every generation has password habits, and many of them are easy to guess.

In the U.S., some of the most commonly used passwords are still variations of “admin,” “password,” and simple number strings like “123456.” These are the very first combinations attackers try using automated tools.

While the exact passwords vary, the structure behind them is surprisingly consistent. Short patterns and repeatable formats show up again and again.

• Gen Z and millennials often rely on number strings and quick keyboard patterns
• Gen X mixes number strings with simple words and names
• Boomers tend to use names more frequently, which are still easy for attackers to guess

If any of that sounds familiar, you’re not alone. The goal isn’t perfection. It’s avoiding the most predictable choices.

If you want the biggest security improvement with the least effort, these changes matter most.

• Use a password manager so every account can have a unique password
• Switch to long passphrases instead of short passwords
• Turn on multi-factor authentication wherever possible
• Check if your email or passwords were exposed so you know what to update first
• Use passkeys when supported for a more secure, password-free login

• Update your email, Apple ID, and banking accounts first
• Enable multi-factor authentication on those accounts
• Then move on to shopping, social media, and streaming services

You don’t need to overhaul everything in one day. Even a few smart updates make your accounts far harder to break into.

Sources

NordPass — Most Common Passwords Report

CISA — Use Strong Passwords

Have I Been Pwned — Check if your email has been exposed

NIST — Digital Identity Guidelines (SP 800-63B)