Risks of Using a Weak Password
Hackers target companies—both small and large—and manage to steal user credentials; in 2024 alone, Viamedias, Almerys, France Travail, Auchan, the French Football Federation (FFF), Picard, Boulanger, Norauto, SFR, and Free all experienced data breaches.
Passwords should be stored as hashes, an irreversible fingerprint—but if a password is too simple, a brute‑force attack (trying every combination) or a dictionary attack (testing known passwords and their variations) becomes feasible and is highly likely to succeed.
Once the password is discovered, the hacker can access your online data (email, photos, etc.), post on your behalf, or simply steal your accounts. One can easily imagine the reputational or financial impact on a company if false information is spread or financial records are exfiltrated.
How to Construct a Strong Password
The ANSSI (National Cybersecurity Agency of France) recommends a password of at least 12 seemingly random characters, including special symbols.
The goal is to ensure that an attacker cannot discover your password automatically in a reasonable amount of time. If they can retrieve most passwords within a few hours, it’s unlikely they’ll leave their machine running for months to crack the remaining ones.
As you can see in the table below, password length and the size of the character set dramatically affect the time required for an attack.
A practical way to increase length is to use a passphrase: imagine a sentence or a few random words, then insert special characters (for example, between words) and sprinkle in some numbers.
Common Pitfalls
A compendium of the most frequent password mistakes:
Writing or saving in plain text
Countless passwords are found on sticky notes or stored in text files. The issue with paper is obvious—but what’s wrong with keeping them in a file? There’s no security: a passing virus or the theft of your computer instantly exposes your passwords.
Using a “burnt” password
Lists of the most common passwords circulate every year. For 2025, they are:
- password
- 123456
- 123456789
- guest
- qwerty
- 12345678
- 111111
- 12345
- col123456
- 123123
Sharing accounts
Especially common in professional environments, sharing credentials multiplies risk. If just one user is compromised, all users and data are exposed—and employees who leave the company often retain access.
Reusing your password
“I’ve found a good, long, complex password—can I use it everywhere?”
NO. As we’ve seen, breaches happen, and sooner or later your password will be exposed. Limiting the impact requires using a different password for each service.
Solutions ?
Nex week, we will discuss additional security measures (2FA) and password managers.
