There are plenty of lists of horror passwords. Those that are too short or too simple or too easily guessed. Chances are your passwords are reused in whole or part, that they have leaked or been stolen, and that they’re on plenty of dangerous lists.
The team at Hive Systems have complied a chart to color-code the passwords you should use and those you should not. It’s a perfect illustration as to why length matters, why numbers alone are a nightmare, and why all those prompts push you to include numbers, upper and lower case letters, and symbols.
You’ll note which passwords are “instantly” hacked and which take minutes, hours, days or even years to crack. If you have lurking in the dangerous purple or red zones, you’ll need to go change those right away. But also bear in mind that, per Microsoft’s warning, “the password era is ending.” Maybe none of this matters anymore.
Wherever you can, add passkeys to your accounts. These replace usernames, passwords and two-factor authentication (2FA) with a sign-in linked to your hardware device, essentially unlocked with a PIN, fingerprint or Face ID. That means there’s no password or code to steal, bypass or trick you into sharing.
Absent a passkey, you need to ensure 2FA is enabled and it’s not SMS-based. An authenticator app on your phone is fine. If you do that, then your password is no longer an access key to your account, it’s a trigger for a 2FA code check. And if you use an app instead of a texted code, then you’ll prevent most bypasses or 2FA attacks.
But as Microsoft also warns, even if you set up passkeys, your password is still dangerous if it remains as a backup access means into your account. And so it’s strongly advised to ensure that your passwords are long and unique and complex, that you use a standalone password manager to keep them safe, and you avoid SMS for 2FA.
Hive Systems ran its testing using a black box approach, essentially starting from scratch to brute force an attack. In reality that’s not what happens. Attackers have head-starts through breaches, common password lists and other techniques. Albeit if your password is in that “instantly” zone, you can’t get much faster than that.
“Password reuse, short character lengths, and weak complexity remain some of the easiest ways attackers gain access to systems,” Hive Systems warns. “The 2025 Hive Systems Password Table is a proven tool to communicate risk clearly and spark action. Use it to change habits, strengthen defenses, and support better security hygiene.”
