I wonder how much of this stems from two stupid IT policies. For decades users have been told to not write down passwords and to change them regularly. The result of this policy is to use a small number of password variations that one reuses. Then IT complaims about it.

The better plan has always been to use long random passwords that you never reuse and write them down by some method like a password manger and only change them rarely for example when they may be compromised,

Which half? The hunt half or the er2?

yeah because half of them are 1234

I'm glad I've been using a password manager for several years now.

https://xkcd.com/936/

I would do the word jumble suggested by xkcd, but so many websites require numbers, special characters, and disallow spaces that it would be impossible to remember unique passwords between those sites. Ironically I end up in a much weaker password ecosystem because I re-use the nearly-same password over and over again so I'm not constantly requesting a reset.

Always two there are. No more, no less. The one they know, and the one they don't.