# Password ideas: why the ones you come up with don't work

> Name plus year, an @ instead of an a, the dog's name, the number plate, a walk across the keyboard. The ideas you'd think of are the ones an attacker tries first, and here they are measured one by one.

2026-09-04 · David Carrero · password.es
Original: https://password.es/en/blog/password-ideas-why-yours-dont-work/

---

There is a search people make constantly: **password ideas**. It makes perfect
sense — the form is sitting there, you have to invent something, and nobody has
ever explained how it's done.

The trouble is that the word *ideas* is already the mistake. A good password is
not a good idea. **It's a password with no idea behind it.**

That isn't a nice line to open an article with. It's literally how an attack
works.

## The list of ideas you'd come up with is the list he runs first

A dictionary attack doesn't start at `aaaaaaaa` and count upwards. It starts with
the passwords that have already leaked by the million, moves on to first names,
common nouns, cities, football clubs and four-digit years. And on top of that
base it applies rules: capital at the front, a digit or a `!` at the end, `a` for
`@`, `e` for `3`, `o` for `0`, the word backwards, the word twice.

Those rules are neither secret nor new. They've been written down for decades and
they ship as standard in every cracking tool. Put another way: **the catalogue of
bright thoughts you'd call "password ideas" is, more or less in order, the config
file of the person attacking you.**

From here on, every figure comes from this site's [checker](/en/checker/), which
assumes an **offline attack at 10¹² guesses per second against a fast hash**.
That assumption is printed under the result, and without it no time figure means
anything. You can reproduce every number yourself: type the example and look.

## Idea one: your name and the year you were born

`Sarah1985`. Nine characters, a capital, four digits. It satisfies what half the
internet demands.

The checker splits it in two at a glance: **"It's in our dictionaries"** for
`Sarah`, **"Looks like a year or a date"** for `1985`. The result is **159,000
guesses**, which at that rate is *less than a second*.

Notice why it's 159,000 and not an astronomical number. It isn't that the
password is short. It's that it isn't nine decisions, it's two: which name and
which year. Common first names run to a few thousand; the years people actually
put in a password run to a few dozen. Multiply them and you're done — you typed
nine characters and picked from fewer than two hundred thousand possible
passwords.

## Idea two: swapping the a for an @

This is the trick everyone believes in, and the one that ages worst.

`S@r@h1985` comes out at **308,000 guesses**. It went up, yes: to exactly double.
And **double nothing is still nothing** — the checker still measures it in under
a second — because the substitution didn't create a new password. It added one
binary question the attacker had already budgeted for: did this person swap the
`a` or not?

Look closely and the checker doesn't even change its verdict. It still says "It's
in our dictionaries", now with the note *with numbers standing in for letters*.
It found the word anyway.

If you want to see how far this goes, try the canonical example. `P@ssw0rd` —
capital, at sign, zero, that whole air of having been thought about — falls in
**17 guesses**. Seventeen. You can count that on your fingers with a little
patience.

## Idea three: writing it backwards

`haras1985` comes out at **159,000 guesses**. The same number, down to the last
digit, as `Sarah1985`.

It isn't that reversal helps a little. **It changes nothing whatsoever.**
Reversing the word is one of the rules the dictionary ships with, so the checker
finds it just the same and labels it just the same, this time with the note
*written backwards*.

The same goes for doubling it: `SarahSarah` drops to **2,983 guesses** — typing
twice as many letters leaves you *worse off* than before, because "it repeats a
chunk" is a named pattern too.

## Idea four: walking your fingers across the keyboard

When someone doesn't want to think, they look at the keyboard and trace a shape.
Out comes `qwerty123`, or `1qaz2wsx`, or `1q2w3e4r`, or `asdfghjkl`.

It feels random because it means nothing. But a keyboard has a fixed and very
small geometry, and tracing it is precisely what a program does better than you:

- `qwerty123` → **273 guesses**.
- `1qaz2wsx` → **29 guesses**.

Twenty-nine. These are so well worn that the keyboard rules aren't even needed:
they show up verbatim in the leaked-password lists, and the checker flags them
with a curt "It's in our dictionaries".

## Idea five: the dog, and the date you'll never forget

`Toby2015!` is a password with a biography: the dog's name, the year he arrived,
and an exclamation mark to keep the form happy. It comes out at **1,2 × 10⁸
guesses**, and it's still *less than a second*.

The most common pet names number a few thousand, and they sit in the same lists
as human names. The trailing `!` contributes what any rule everyone follows
contributes: nothing.

The meaningful date is worse still. `24121985` — a day, a month, a year — reads
like eight digits, but the checker labels it "Contains a date" and settles it in
**14,966 guesses**. The reason is the calendar: there are 31 days, 12 months and
a long century of plausible years. Eight digits that look like ten million
combinations are, in fact, about fifteen thousand.

That's the trap in a date: **it gives you length without giving you
uncertainty**, and uncertainty is the only thing that gets paid for.

## Idea six: the number plate, and what the checker cannot see

`4521KDR` is different, and worth stopping on.

Here the checker says **"We found no known pattern"** and calculates **3,9 × 10¹⁰
guesses**. But it flags that number as a **ceiling**, and that word is the
important part: it didn't find your pattern, which doesn't prove you haven't got
one. Even so, and being generous, the time is still *less than a second*.

And there's the gap you need to understand. The checker doesn't know what car you
drive. Someone who knows you, who has your Instagram open, or who bought a data
dump with your plate in it, doesn't need 3,9 × 10¹⁰ guesses: they need one.
**The number you see when there's no pattern measures a stranger's ignorance, not
the ignorance of someone who went looking for you.**

The same holds for your house number, your ID number, your phone and your wedding
date.

## What all six have in common

None of these ideas fails for being "not complex enough". They all fail for the
same reason: **they are autobiography**, and autobiography can be guessed. Your
name, your year, your dog, your car, the way you trace a keyboard. Each of those
decisions feels personal and yours, and that is exactly why it belongs to a short
list somebody has already written down.

Adding complexity fixes nothing, because the complexity *you* apply is also a
decision of yours and also sits on the list. That's why `S@r@h1985` gains a
miserable factor of two and `haras1985` doesn't gain even that.

If you want the argument in numbers, it's in
[entropy bits](/en/blog/what-are-entropy-bits/): what counts is not how many
passwords you *could* have written, but how many are left once everything known
about your tastes has been subtracted.

## The way out isn't a better idea: it's having no ideas

The only way off the list is for the password not to come out of your head.

That is exactly what [Diceware](/en/blog/diceware-dice-pick-better-passwords-than-you/)
does: you roll five dice, look the number up in a list of 7,776 words, and write
down whatever comes out. Each roll is worth 12.9 bits, and it's a real 12.9,
because dice have no tastes, no memory and no idea what year you were born. Six
words come to roughly 77 bits.

Put one in the checker and watch what changes: six ordinary words picked by dice
go from "Very Weak" to **"Very Strong"**, and the time stops being measured in
seconds. Not because they're convoluted — they aren't, they're six normal words —
but because **they're the one part of your password you didn't decide**. If
you'd rather the browser rolled for you, the [generator](/en/) runs the same draw
and shows you the bits while it does it.

So the honest answer to "give me some password ideas" is that you don't need any,
and in fact you have too many already. What you're missing is a die.

---

*Sources: every figure in this article comes from the password.es checker, which
declares its model under the result — 10¹² guesses per second, offline attack,
fast hash — and all of them are reproducible by typing each example into
[/en/checker/](/en/checker/) · the pattern-matching engine is zxcvbn, by Daniel
Lowe Wheeler (Dropbox), presented at USENIX Security 2016 as "zxcvbn: Low-Budget
Password Strength Estimation" · the substitution, reversal and repetition rules
quoted here are the ones that ship as standard in dictionary-attack tools ·
Arnold G. Reinhold, "The Diceware Passphrase Home Page" (1995), for the 7,776
words and the 12.9 bits per roll.*