Passwords and sign-ins
Why “Summer2025!” is not a strong password
It has a capital letter, numbers and a symbol. It also looks like millions of other passwords.
1 min readExplainer
The short version
Passwords built from a season, a year and a symbol meet most complexity rules and are among the first things attackers try.
The patterns attackers know
When people are asked for a password with an uppercase letter, a number and a symbol, they tend to make the same choices:
- A season or month plus the year: Summer2025!, January2026
- The company name plus a number: Acme123!, Acme2025
- A sports team, pet or child’s name plus a birth year
- Keyboard patterns: Qwerty123!, 1qaz2wsx
- The word “password” dressed up: P@ssw0rd!
- The old password with the last number changed: Spring2025! becomes Summer2025!
Attackers know these patterns. In an attack called password spraying, they try a handful of common ones against every account in a company. They only need one person to have chosen Summer2025!.
What works better
- Length over complexity. A passphrase of four or more unrelated words is longer and harder to guess, and easier to remember.
- A different password for every account. A password manager makes this practical.
- Nothing personal or local. Avoid your company name, town, team or anything from your social media.
- Multi-factor authentication. Even a guessed password should not be enough to get in.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.