While it may seem as if there are a lot of words in English (over 300,000 according to Dictionary.com), these are a standard part of a ‘dictionary attack’ program, and take very little time to work through – therefore, never use single words (Holiday, Friday, Weekend, Password etc) as a password!
Note: ‘dictionaries’ and ‘rainbow tables’ (databases of pre-populated combinations) used in attacks are also updated with prefixes/suffixes (for example, years, numbers, commonly used/substituted characters such as ! or *;@ for ‘a’, 0 for ‘o’ etc. They really do think of everything, these criminals!).
See also: Top 200 most commonly used passwords
TIP: Passphrases, not passwords! Combining a random string of words (as well as numbers, mixed cases and other characters), ensures a much stronger ‘passphrase’, and make it more likely for the owner to remember it.
For example: “candle” as a password would be considered very weak. “digitopencandlefridge” – a long, random combination of words - would be considered a strong passphrase. However, “DigiT42openCand!eFridge9” would be stronger still .