Assuming I know a person who made-up a password with the goal that it should be random because he will use it for a important service. I would like to figure out how I can increase my chance to guess the password. The first step is to think about the typical human weaknesses at generating a password.

One weakness which comes to my mind is that certainly some characters are typically more often chosen than other. I think we have a strong bias to [A-Za-z0-9] because these characters are easy to type.

But I think there are a lot more human weaknesses. For example humans are very good pattern-recognition machines so maybe we unintentionally use patterns for example from words or numbers (even if we try not to do it). But that's very vague.

So what are additionals weaknesses and why they exists?

  • 1
    It comes down to how the person made it up. For example, when I want a random password quickly (i.e. not for something I care enough about to make properly secure), I mash the keyboard at random. So you could increase your chances of guessing my passwords for those services by looking at a heat map of which keys I'm likely to hit, and maybe factoring in things like probably alternating between left & right hand, and index finger hitting the keyboard first, etc. But if your target made up the random characters in their head, you need to do something different (e.g. it probably contains a "7")
    – Dave
    Commented Jul 13, 2017 at 12:01
  • 2
    made up password != random password. Maybe I'm bit-shifting semantics here, but it makes quite a difference.
    – Jacco
    Commented Jul 13, 2017 at 12:11
  • 1
    Relevent (again): xkcd.com/936
    – Baldrickk
    Commented Jul 13, 2017 at 13:07
  • 1
    I certainly believe that most answers to this question might be primarily opinion-based, but I also think that there are probably academic studies that deal with parts of the question and I would be interested in seeing them. Commented Jul 13, 2017 at 13:35
  • You could try machine learning Commented Jul 14, 2017 at 18:18

3 Answers 3


Disclamer: I have no source for this. This is all based on personal experience

Since most sites today dictates a password policy where passwords must have at least one digit and one uppercase character, the structure is almost always:

  • One uppercase character
  • X lowercase characters
  • One or two digits at the end.

If symbols are required, they're often appended after the digit - most commonly !

  • 4
    guilty as charged
    – Snappie
    Commented Jul 13, 2017 at 9:13
  • 2
    I would add something from myself, capital first letter is often capitalised.
    – user902383
    Commented Jul 13, 2017 at 10:19
  • 5
    Without references this is mainly speculation though and not necessarily an answer to the question.
    – Arminius
    Commented Jul 13, 2017 at 11:28
  • Don't forget no-digit passwords with trivial substitutions (e.g. p4$$w0rd).
    – CompuChip
    Commented Jul 13, 2017 at 13:14
  • 2
    After reading this, and noticing that all of my passwords match that, I think it's time to change my passwords... In short, maybe don't let your passwords match ^[A-Z][a-z]+[0-9]+\W*$
    – Mayube
    Commented Jul 13, 2017 at 13:26

This is not quite as straight-forward as you might think. It is certainly true that people are bad random number generators, as discussed here (although please don't take their attempts at statistical analysis seriously).

So while there is some truth behind the idea you are getting at, in practice it is substantially more messy. Just because people aren't good at being random doesn't mean that there is a reliable way for you to guess what a particular person might choose as a secure password. Your best bet to get someone's password without being given it would be one of two ways (which don't have to be mutually exclusive):

  1. A targeted attack to get the person's password! Basically, execute some kind of social engineering attack
  2. Hope that your target is an "average" person and guess their password, not based upon anything about them, but instead by patterns that people follow on average. Basically that means try every password in this list. Just because it is an important service doesn't mean that your average person is going to use a secure password.

I don't think there is a pattern here.

Each person might have own way to generate pattern.

If I ask my mum to create password for herself, it will be something like her mother maiden name followed by some number (most probably a date).

If i ask someone more security aware, password might be created from first letter from each word in first verse of his favourite song.

If you ask me, random password will be based on some geometrical pattern build from keys ie spiral gyhbvft67ujn

Not the answer you're looking for? Browse other questions tagged .