Every year, millions of leaked credentials are analysed to determine the most common passwords people still use.

Avoid every password on this list by using a password manager like NordPass to generate and store strong, unique passwords that are impossible to crack — it handles the complexity so you do not have to.

{"type":"result","subtype":"success","is_error":false,"api_error_status":null,"duration_ms":27314,"duration_api_ms":28269,"ttft_ms":2449,"ttft_stream_ms":1955,"time_to_request_ms":316,"num_turns":1,"result":"

How Researchers Compile the Most Common Passwords List

\n

The rankings you see each year aren't guesswork. Security researchers aggregate hundreds of millions of credentials exposed in real-world data breaches, then strip out duplicates and sort by frequency. Sources include public breach corpuses, dark-web credential dumps, and honeypot servers designed to capture the exact strings attackers try first. When a password like 123456 appears in more than 4 million separate accounts, it earns the top spot not because it's clever, but because it's everywhere.

\n

This methodology matters because it reveals attacker behavior, too. Criminals don't brute-force one character at a time anymore. They load these exact lists into automated tools and test them against millions of accounts in minutes — a technique called credential stuffing. If your password sits anywhere in the top 200, an automated bot can compromise your account in under one second.

\n\n

Patterns That Keep Showing Up Every Year

\n

Beyond the obvious offenders, the same predictable patterns dominate the list year after year. Recognizing them helps you avoid creating a \"weak password in disguise\" that merely looks secure:

\n

\n
• Keyboard walks: qwerty, asdfgh, 1qaz2wsx, and zxcvbnm feel random but follow the physical layout of your keyboard.
\n
• Sequential numbers: 123456, 12345678, and 111111 remain the single most common category of leaked credentials.
\n
• Names and pop culture: superman, iloveyou, dragon, and the perennial password all rank in the global top 50.
\n
• Predictable substitutions: swapping a for @ or o for 0 (as in P@ssw0rd) fools no one — cracking tools test these variants by default.
\n
• Years and dates: appending 2026 or a birth year to a common word adds almost no real entropy.
\n

\n\n

Why a Weak Password Costs More Than You Think

\n

The fallout from a single guessable password rarely stays contained. Because roughly 65% of people reuse the same password across multiple sites, one breach becomes a master key. Attackers take credentials leaked from a low-value forum and replay them against your email, banking, and cloud storage. From there they can reset other passwords, drain accounts, or impersonate you to your contacts.

\n

Consider a practical example: a hobby gaming site gets breached and your football1 password leaks. Within hours, automated systems test that same combination against Gmail, PayPal, and Amazon. If you reused it, the damage spreads far beyond the original site — and you may not notice until money or data is already gone.

\n\n

How to Build a Password That Never Makes the List

\n

The good news is that escaping these rankings is simple once you follow a few evidence-based rules. Modern security guidance from NIST emphasizes length over forced complexity, so focus your effort there:

\n

\n
• Aim for 16+ characters. Length is the single biggest factor in resisting brute-force attacks. A 16-character random password would take centuries to crack with current hardware.
\n
• Use a passphrase. Four or five unrelated words like copper-violin-thunder-maple are easy to remember and mathematically stronger than a short scrambled string.
\n
• Make every password unique. Never reuse credentials across accounts, so a single breach can't cascade.
\n
• Generate, don't invent. Humans are terrible at randomness. Use a trusted password generator to produce truly unpredictable strings.
\n
• Store them in a password manager. Tools like Bitwarden, 1Password, or KeePass let you keep hundreds of unique passwords behind one strong master key.
\n

\n\n

Add a Second Layer With Two-Factor Authentication

\n

Even the strongest password can be phished or intercepted, which is why two-factor authentication (2FA) is essential. By requiring a second proof of identity — an authenticator app code, a hardware security key, or a biometric scan — you ensure that a stolen password alone isn't enough to break in. Prioritize app-based or hardware 2FA over SMS, since text messages can be intercepted through SIM-swapping attacks.

\n\n

The Bottom Line for 2026

\n

If your password appears anywhere on this year's top 200 list, treat it as already compromised and change it today. The pattern is clear: attackers win when we choose convenience over security. Swap predictable strings for long, unique, randomly generated passphrases, enable 2FA everywhere it's offered, and let a password manager carry the memory burden. A few minutes of setup now is the difference between staying secure and becoming next year's breach statistic.

","stop_reason":"end_turn","session_id":"18a90289-d102-4270-8a41-b17ec9e31e2f","total_cost_usd":0.12024,"usage":{"input_tokens":8492,"cache_creation_input_tokens":2333,"cache_read_input_tokens":15362,"output_tokens":1835,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":2333,"ephemeral_5m_input_tokens":0},"inference_geo":"not_available","iterations":[{"input_tokens":8492,"output_tokens":1835,"cache_read_input_tokens":15362,"cache_creation_input_tokens":2333,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":2333},"type":"message"}],"speed":"standard"},"modelUsage":{"claude-haiku-4-5-20251001":{"inputTokens":799,"outputTokens":19,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.000894,"contextWindow":200000,"maxOutputTokens":32000},"claude-opus-4-8[1m]":{"inputTokens":8492,"outputTokens":1835,"cacheReadInputTokens":15362,"cacheCreationInputTokens":2333,"webSearchRequests":0,"costUSD":0.119346,"contextWindow":1000000,"maxOutputTokens":64000}},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"89164683-8e17-4a5f-826f-0ee620200254"} {"type":"result","subtype":"success","is_error":true,"api_error_status":401,"duration_ms":669,"duration_api_ms":0,"num_turns":1,"result":"Invalid API key · Fix external API key","stop_reason":"stop_sequence","session_id":"1241d270-8883-4613-a96c-e27f9e26d027","total_cost_usd":0,"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":0,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"","iterations":[],"speed":"standard"},"modelUsage":{},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"8996e633-fcf2-463a-b9c4-b92415d9db47"}