I used be lead dev for a big streaming site with >2m users and, well, no judgment here please, but the passwords were plaintext in the database.

So me and another dev ran a SQL script to see what the most common were.

  #1 was trustno1
  #2 was password
  #3 was 1234

We had no password rules either, so IIRC you could have a 1-char password.