Using simple, predictable passwords makes accounts vulnerable to dictionary and brute-force attacks.
Using the same password across accounts means one breach compromises all of them.
Keeping the same password for years increases the chance of eventual compromise.
Sending passwords through email, SMS or chat leaves a permanent unencrypted record.
Storing passwords in spreadsheets, sticky notes or phone notes is unsafe and easy to lose.
Not enabling Multi-Factor Authentication is the single biggest avoidable risk.
Relying on browser password storage without a master password or device encryption.
Keyboard walks, birthdays, and dictionary words are tried first by attackers.