Habits from signing in to things · habit 17 of 40

The password shape you always use

Almost nobody reuses one password any more. What people do instead is keep one shape and change the end of it, which feels like variety and is not.

The habit

You build the password from a formula you already know and change only the ending.

Why it is automatic

Password rules taught this directly. A person told to include a capital, a digit and a symbol will put a capital at the front, a digit at the back and a symbol between, because that is the least effortful arrangement that passes. Told to change it often, they increment the digit. The formula was invented by the rules, not in spite of them.

The habit also survives because it works. It defeats the simplest attack, which is reusing one leaked password unchanged on other sites. People who adopted a shape were following the best advice available at the time.

And it is the only method most people have that needs nothing else present. A shape can be produced on a borrowed machine, on a phone with no software installed, on a keyboard in another country. That portability is real value, and any replacement has to reckon with it.

What it actually does here

The mechanical fact is that a shape is not a property of one password. It is a property of you. Every place that ever received a password of yours received an example of the rule, and any one of them leaking at any point is enough to describe what you would type today.

Guessing the ending is not hard once the rule is known. Endings are chosen to be rememberable, which means they come from the site: a fragment of the name, an abbreviation, the first and last letter, the year the account was made. Somebody with one example and the site name has a very short list to work through.

What differs here is what sits behind a failure. Everywhere else, an account taken over is an inconvenience with a path out of it. The mail address proves you and the account comes back. On this site the credential is the account. There is nothing to prove anything to and no queue to join.

There is also no notification. Nothing sends a message about a sign in from somewhere new, because nothing has anywhere to send one. A guessable credential and a silent outcome together are what make this worth breaking for one account, even if you keep the habit everywhere else for life.

What a shape gives away

It is worth being precise about the loss, because it is larger than it looks. A leaked password from an old forum is one string. A leaked password that reveals a formula describes every password you will ever produce by hand, including ones you have not made yet. The exposure runs forwards as well as backwards.

That is also why lengthening the shape helps less than people hope. Adding two characters to a known rule produces a known rule with two more characters. Strength against guessing comes from the number of possibilities, and a formula collapses those to a handful the moment the formula is known.

The thing that actually breaks the pattern

The only reliable fix is a password you did not compose, because anything a person composes carries their fingerprints. A generated string of reasonable length has no rule inside it, no relationship to any other password you hold, and cannot be extended from an example. It is also unmemorable, which is the point, and why it has to live somewhere other than memory.

That moves the problem rather than removing it. Where the string lives becomes the question, and the answer is not the browser doing it silently for you, which is its own reflex and sits under habits learned in the browser. The honest options are a manager you deliberately open, or paper you deliberately keep. What matters is that it was a choice rather than a default.

What to do instead

Treat this as one account exempt from your usual system, rather than as a project to reform every password you own.

1. Generate the string rather than composing it. Anything you can produce from memory at a keyboard has a rule in it.
2. Make it long. Length is the part that costs an attacker time and costs you nothing once you are not remembering it.
3. Do not let it share any fragment with a password you already use, including the ending.
4. Decide where it will live before you generate it, and put it there in the same sitting rather than promising to do it later.
5. Keep it with the recovery details, since the assumption that a reset exists is the habit that usually removes the second copy.

How to notice you did it anyway

The test for this one is uncomfortable and quick. It asks how much of your own scheme somebody could rebuild from a single example.

• Write down two passwords you use elsewhere and see whether a stranger holding one could produce the other.
• Count how many passwords you can type from memory. Any number above about three usually means a formula rather than a memory.
• Check whether the ending you used here can be derived from the name of the site.
• Look at whether the password you made here is longer than your usual ones but built the same way.
• Ask whether you would recognise your own scheme in a list of leaked strings. If yes, so would anyone else.

What readers ask about this habit