Pass1234 Is Not a Password. Here's What to Use Instead.

If you searched for “pass1234” or “pass@1234”, one of three things is probably true. You were handed it as a default password. You are using it somewhere and wondering whether it’s fine. Or you saw it on a list and wanted to know why.

It is not fine. Here is how bad it is, with real numbers, and what to do instead.

How often these passwords show up in breaches

Have I Been Pwned keeps a public database of passwords exposed in real data breaches, and you can check any password against it without sending the password itself. We checked these on September 24, 2026:

Password	Times seen in breaches
pass1234	854,288
Pass1234	400,218
pass@1234	173,267
Pass@1234	1,569,340
Password1	3,461,492

Look at the last two variations. Adding a capital letter and an @ sign did not make the password rarer. Pass@1234 turns up more than pass1234 does, because it is exactly what people type when a system demands “one uppercase letter, one number, one symbol.” Attackers know that too.

Why “complex” passwords like Pass@1234 fail

Nobody guesses passwords by hand anymore. Attackers use lists: billions of real passwords from past breaches, plus the predictable ways people modify them. Capitalize the first letter. Swap an “a” for ”@”. Add “1234” or the current year to the end.

Pass@1234 is on those lists. So is every obvious variation of it. A password that is on a list gets tried in the first few seconds, no matter how many symbols it has.

The bigger risk is reuse. If the same password protects your email and a shopping site, a breach at the shopping site hands attackers your email login. That’s one of the most common ways business accounts get taken over: not by cracking a password, but by trying one that already leaked.

What NIST actually recommends now

NIST’s digital identity guidelines (SP 800-63B, revision 4, finalized in 2025) are the standard most security frameworks follow. They reversed a lot of the old advice:

• Length beats complexity. Passwords used on their own should be at least 15 characters. Systems should allow at least 64.
• No forced composition rules. No more “must include a symbol.” Those rules are what produce Pass@1234.
• No forced periodic changes. Change a password when there’s evidence it was compromised, not every 90 days.
• Block known-bad passwords. Systems should reject passwords that appear on breach lists, which would stop every password in the table above.

What to do instead

Use a password manager. It generates a long, random, unique password for every account and remembers them for you. You remember one strong passphrase to unlock it. This is the single biggest improvement most people can make.

Where you have to remember a password, use a passphrase. Four or five unrelated words are long, easy to type, and not on anyone’s list. A made-up example: copper lantern gravel autumn (don’t use this one; it’s published now).

Turn on multi-factor authentication (MFA). With MFA, a stolen password on its own isn’t enough to get in. For email and anything financial, MFA matters more than any password rule.

Change default passwords immediately. If a device, a router, or a new account came with pass1234 or something like it, change it before anything else, and check that nobody else was given the same one.

For businesses: fix it in the system, not the sticky note

If your staff are choosing passwords like Pass@1234, the problem is usually the policy that made them. A complexity rule plus a 90-day expiry produces exactly this.

The fix is structural. Microsoft 365 can block common and weak passwords and require MFA for everyone, and a company password manager gives staff a way to comply without writing passwords down. MFA enforced everywhere it can be is part of the cybersecurity baseline we set up for clients, along with phishing training, since a strong password doesn’t help if someone types it into a fake login page. See also how attackers get around MFA with consent phishing.

If you’re not sure what your own passwords and MFA look like across the company, that’s one of the first things our IT risk assessment checks.