Do NOT make username and password the same, your website will be hacked.

Having the same password as username or includes username will get you hacked 99.9% of time.

Here are other real bad ones:

password, jordan, any type of number combination without a letter, any type of name, and anything that can be found in the dictionary.

It's recommended to use password with a combination of letters, numbers and special characters.