Password Security
Why a Password Variation Is Not a New Password
Changing one number, symbol, season, or site name does not make a breached password truly new. This guide explains why variations are predictable and how consumers can replace them safely.
A variation keeps the old pattern alive
A password variation is not a truly new password because it preserves the same pattern. Changing a year, adding an exclamation mark, replacing a letter with a number, or adding the website name may feel different to you, but it can be predictable after exposure.
If an old password was breached or guessed, small changes may be tried next. A safer replacement is unrelated, unique, and stored in a password manager.
You do not need to prove that attackers know your pattern. If a password matters, replace variations with genuinely distinct passwords.
Common variation patterns
People make variations because they are easy to remember. Unfortunately, easy-to-remember patterns are often easy to test. A criminal does not need to know you personally if the pattern is obvious.
NIST recommends password managers because they reduce the need to invent memorable patterns for every site. The strongest routine is to let the manager create unrelated passwords.
Variations are especially risky when the base password appeared in known exposure data.
- Adding 1, 2, or 123.
- Changing 2024 to 2025.
- Adding ! or ?.
- Replacing a with @.
- Adding the website name.
- Using the same phrase with small edits.
Check exposure without sharing the password
Use email or username exposure checks to understand where risk may exist. Do not enter current passwords into random exposure checkers.
If you suspect a password pattern was exposed, replace the whole family of related passwords. A clean result only means no known match was found in the searched sources.
Replace the pattern, not just one account
If one password variation is risky, look for every account using the same pattern. Replace them with unrelated unique passwords.
Start with email, finance, password manager, cloud storage, phone carrier, work tools, and social media.
Use generated passwords
A password manager can generate random passwords that do not share a pattern. That is the easiest way to escape variation habits.
Protect the password manager with a strong master password and MFA if available.
Enable MFA on important accounts
CISA recommends MFA because it reduces risk when passwords are guessed or stolen. Add it while replacing password variations.
Use passkeys, security keys, or authenticator apps where available.
Avoid writing patterns in notes
Do not keep a note that says how you modify each password. If someone sees the pattern, many accounts can be guessed.
Store actual unique credentials in a password manager instead.
Review old accounts
Old accounts are where password variations often survive. Search your inbox for signups and close accounts you no longer need after saving records and removing payment methods.
A clean password routine becomes easier once old accounts are removed.
Frequently asked questions
Is changing one character enough after a breach?
No. Use a new unrelated password, especially if the old one was exposed or reused.
Can attackers guess password variations?
They often try common variations such as years, punctuation, substitutions, and site names.
What is the best replacement?
Use a password manager to generate a unique password for each account.
Sources
This guide is reviewed against official guidance. External pages may be updated by their respective owners.