Common Password Mistakes
By Mihaly Kertesz · Updated
Password reuse, predictable credentials and fragile recovery are recurring causes of account and vault problems. Password length helps when the value is unpredictable and handled through a trusted workflow. A manager can reduce routine mistakes while retaining the information needed for recovery.
Password reuse mistakes across accounts
A leaked credential can be tried on another service without guessing it. Email and accounts that reset other logins create particularly important dependencies. Independently generated replacements break the relationship between reused values.
A familiar suffix or annual number leaves the base text predictable. It does not make related passwords independent.
Independent password generation · Credential stuffing and phishing
Predictable master password mistakes
Quotations, personal stories and familiar self-selected words have different predictability from independently sampled words. A documented random process and its wordlist size determine the generation model.
Passary’s word tool uses 864 unique words. Eight independent selections provide approximately 78 bits of selection entropy. This describes generation rather than measured resistance to every attack.
Random passphrase tool · Master passphrase selection and recovery
Password recovery mistakes
A recovery code available only inside an inaccessible vault cannot recover that vault. An account password held only on a lost phone creates a similar dependency. Protected recovery material outside the primary failure path avoids this loop.
An encrypted backup may also require a keyfile. Device biometrics and convenience PINs do not necessarily survive a reinstall or replacement.
Plaintext password export mistakes
CSV and unencrypted JSON are interchange formats, rather than protected backups. A forgotten export in Downloads can remain a readable duplicate of many credentials. Destination verification and removal of unnecessary temporary copies limit that exposure.
Public validators, converters and support conversations create further copies when supplied a real export. Fictional samples can demonstrate headers, quoting and structure without secret contents.
Password mistakes involving phishing
Domain checking and supported origin matching help distinguish the intended service from a false login page. An unexpected approval prompt or master-password request may concern a different authentication flow from the one expected.
Phishing-resistant authenticators can improve origin binding where supported. Their recovery paths, account password recovery and vault recovery remain separate.
NIST SP 800-63B-4: authentication and authenticator management · Autofill behavior and boundaries
Password maintenance mistakes
Important account changes affect the saved credential and backup state. Recovery contacts, MFA arrangements and stale entries can also change over time. Work credentials remain subject to the organization’s applicable policy.
- Independent credentials for critical accounts
- Available email and account recovery paths
- Current encrypted backup with matching factors
- Temporary migration files no longer retained
- Current sharing permissions and credentials