I used be lead dev for a big streaming site with >2m users and, well, no judgment here please, but the passwords were plaintext in the database. So me and another dev ran a SQL script to see what the most common were. #1 was trustno1 #2 was password #3 was 1234 We had no password rules either, so IIRC you could have a 1-char password.
[1] https://arstechnica.com/information-technology/2019/10/forum...