It’s best to assume that a password that meets any of the following criteria is weak:

  • It appears in the English dictionary
  • It is the name of a well-known city anywhere in the world
  • It is the name of any professional sports team
  • It is a calendar date
  • It is a simple pattern, such as abcdef, 98765, or jjjjjj
  • It is the same as the username
  • It is less than six characters long