scan.now
Premium Scan a site

Password follows a predictable pattern

The password follows a structure people use constantly, such as a word plus a year, a capital first letter with a symbol at the end, or a keyboard walk, which cracking rules try first.

Do this: Drop the word-plus-number shape; use unrelated random words. Word plus number plus symbol is the first rule set every cracking tool applies.
PassThe password does not follow a common predictable pattern.
MediumThe password follows a predictable pattern that cracking rules try first.

The fix, in one snippet

Example to adapt What the rules expand 
summer -> Summer2024! Summer2025! Summer@2024 …
All of it is generated automatically in seconds.

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

A pattern classifier runs alongside the strength estimator and names the structures it finds: word plus digits (summer2024), word plus year, capitalised word with a trailing symbol (Welcome1!), keyboard walks (qwerty, 1q2w3e), repeated or sequential characters, l33t versions of dictionary words (P@$$w0rd), dates and birthdays, a name plus a number, the site or brand name inside the password (Facebook123), a season or month plus a year, doubled words, and small mutations of a top-ranked common password. Severity is medium: a pattern removes most of the entropy but a long password with a year appended can still be adequate, so the length estimate has the final say. Limits: these are heuristics; a randomly generated passphrase that happens to end in digits is reported but not penalised heavily.

Why it matters

Cracking tools such as hashcat and John the Ripper apply rule files (best64, dive, OneRuleToRuleThemAll) that transform dictionary words in exactly these ways: capitalise, append one to four digits, append a symbol, substitute l33t characters. A password that feels personal, like Summer2025!, is generated by those rules in the first minutes of a run. Password spraying exploits the same habit: attackers try season-plus-year-plus-symbol against every account in an organisation, because rotation policies push people to increment the same base word. Corporate users under 90-day rotation are the most predictable.

How to fix it

Break the structure entirely rather than adjusting it. Use randomly generated passwords from a manager for every site, and for the master password you must remember, five or six words chosen by a generator (diceware), not by you. Avoid anything derived from the site, the season, or dates that appear on your social profiles. Administrators: remove forced periodic rotation and composition rules, as NIST SP 800-63B recommends, screen new passwords against breach lists, and require multi-factor authentication so a guessed password alone is not enough. Related: weak passwords and breached passwords. Guides: password security and two-factor authentication.

Where this fits

Password follows a predictable pattern is check 3 of 3 that the password strength & breach checker runs under password security, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Password is weak (high), where the password can be guessed quickly: It is short, drawn from a small character set, or built from dictionary words with predictable changes. An attacker who has that does not need this, so it is the better use of the same hour.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Password follows a predictable pattern (medium severity)
Scanner check id: password-common-pattern
18 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. NIST SP 800-63B: Authentication and Authenticator Management
  2. hashcat wiki: Rule-based attack
  3. NCSC: The logic behind three random words
  4. Microsoft Security: Protecting your organization against password spray attacks

Related guides

8 min read · Updated Sep 11, 2026 Password Security: Length, Reuse, Breaches and How Passwords Are Actually Cracked

Most account takeovers use a password that leaked somewhere else. How passwords are stored and cracked, why length beats complexity, how...

Read the guide 8 min read · Updated Sep 12, 2026 Two-Factor Authentication: SMS vs Authenticator Apps vs Passkeys and Security Keys

A second factor stops most password-based takeovers, but the methods differ enormously in strength. This guide ranks SMS codes,...

Read the guide