Every year, millions of leaked credentials are analysed to determine the most common passwords people still use.

The best way to avoid weak passwords is to use a password manager like NordPass to generate and store strong, unique credentials for every account automatically.

{"type":"result","subtype":"success","is_error":false,"api_error_status":null,"duration_ms":29875,"duration_api_ms":31418,"ttft_ms":3944,"ttft_stream_ms":3460,"time_to_request_ms":215,"num_turns":1,"result":"

The Top 10 Most Common Passwords And Why You Must Avoid Them

\n

When security researchers compile leaked credential databases each year, the same handful of passwords appear at the very top of the list. These are the digital equivalent of leaving your front door wide open. If your password appears anywhere on this list, change it immediately — automated cracking tools test these combinations first, often breaking into an account in under a single second.

\n

\n
• 123456 — Still the world's most leaked password, found in tens of millions of breached records every year.
\n
• 123456789 — Adding three more digits adds essentially zero security.
\n
• password — The classic. Cracked instantly by every dictionary attack ever written.
\n
• qwerty — A simple left-to-right sweep of the keyboard's top row.
\n
• 12345678 — Sequential numbers remain dangerously popular.
\n
• 111111 — Repeated characters are among the first patterns attackers try.
\n
• 123123 — A short repeating sequence that offers no real protection.
\n
• admin — Common on routers, IoT devices, and default accounts.
\n
• abc123 — Mixing letters and numbers in an obvious pattern fools no one.
\n
• password1 — Tacking a \"1\" onto a weak password does not make it strong.
\n

\n

The common thread is predictability. Every one of these follows a pattern a computer can guess by brute force in milliseconds. Modern GPUs can attempt billions of combinations per second, so any password built from a keyboard pattern, a dictionary word, or a short number run is effectively no password at all.

\n\n

Why These Passwords Fail So Quickly

\n

Attackers rarely sit at a keyboard guessing one password at a time. Instead, they run credential stuffing and dictionary attacks using massive lists of previously leaked passwords. When a service is breached, those credentials are bundled and sold, then replayed against thousands of other websites. Because so many people reuse passwords, a single weak password can unlock email, banking, social media, and cloud storage in one chain reaction.

\n

Consider the math. An eight-character password using only lowercase letters has around 200 billion combinations — which sounds large until you realize a consumer graphics card can test that entire space in minutes. Add uppercase letters, numbers, and symbols across sixteen characters, and the same hardware would need thousands of years. Length and unpredictability are the two factors that matter most.

\n\n

How to Build a Password That Actually Holds Up

\n

Strong passwords do not need to be impossible to type — they need to be long and unique. The most practical approach for humans is the passphrase: four or more random, unrelated words strung together, optionally with numbers or symbols mixed in. Something like copper-violin-sunset-42-river is both easy to remember and astronomically harder to crack than P@ssw0rd.

\n

\n
• Aim for length over complexity. A 16-character passphrase beats an 8-character jumble of symbols every time.
\n
• Make every password unique. Never reuse a password across two accounts — one breach should never compromise the rest.
\n
• Avoid personal information. Birthdays, pet names, sports teams, and street addresses are easily found on social media.
\n
• Skip predictable substitutions. Swapping \"a\" for \"@\" or \"o\" for \"0\" is in every cracking dictionary.
\n
• Don't rely on memory alone. If you can memorize all your passwords, they probably aren't strong or varied enough.
\n

\n\n

Use a Password Manager and Enable Two-Factor Authentication

\n

The single most effective change you can make is adopting a reputable password manager. These tools generate, store, and autofill long random passwords for every account, so you only ever need to remember one strong master passphrase. Trusted options include Bitwarden, 1Password, and KeePass, and most browsers now offer a built-in version that syncs across devices.

\n

Pair your password manager with two-factor authentication (2FA) wherever it is offered. Even if an attacker somehow obtains your password, a second factor — an authenticator app code, a hardware security key, or a biometric check — stops them at the door. App-based authenticators such as Authy or Google Authenticator are significantly more secure than SMS codes, which can be intercepted through SIM-swapping attacks.

\n\n

Quick Checklist to Stay Protected in 2026

\n

\n
• Check your email and accounts against a breach-notification service to see if your credentials have already leaked.
\n
• Replace any password that appears on a \"most common\" list today, not later.
\n
• Switch your most sensitive accounts — email, banking, and primary cloud storage — to unique passphrases first.
\n
• Turn on 2FA on every service that supports it, prioritizing hardware keys or authenticator apps.
\n
• Review your saved passwords every few months and update any flagged as weak or reused.
\n

\n

Weak passwords remain the leading cause of account compromise year after year, yet the fix is entirely within your control. By combining a long unique passphrase, a trusted password manager, and two-factor authentication, you move from being the easiest target on the internet to one that simply is not worth an attacker's time.

","stop_reason":"end_turn","session_id":"93836fd7-0a23-4ffc-b6d4-7a237275540f","total_cost_usd":0.124347,"usage":{"input_tokens":8492,"cache_creation_input_tokens":2340,"cache_read_input_tokens":15362,"output_tokens":1997,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":2340,"ephemeral_5m_input_tokens":0},"inference_geo":"not_available","iterations":[{"input_tokens":8492,"output_tokens":1997,"cache_read_input_tokens":15362,"cache_creation_input_tokens":2340,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":2340},"type":"message"}],"speed":"standard"},"modelUsage":{"claude-haiku-4-5-20251001":{"inputTokens":806,"outputTokens":15,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.000881,"contextWindow":200000,"maxOutputTokens":32000},"claude-opus-4-8[1m]":{"inputTokens":8492,"outputTokens":1997,"cacheReadInputTokens":15362,"cacheCreationInputTokens":2340,"webSearchRequests":0,"costUSD":0.12346599999999999,"contextWindow":1000000,"maxOutputTokens":64000}},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"6c8824a9-5e8c-426a-bfb0-1be38ed41811"} {"type":"result","subtype":"success","is_error":true,"api_error_status":401,"duration_ms":568,"duration_api_ms":0,"num_turns":1,"result":"Invalid API key · Fix external API key","stop_reason":"stop_sequence","session_id":"da325d9e-2421-4668-81dc-3c8a2f4136e2","total_cost_usd":0,"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":0,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"","iterations":[],"speed":"standard"},"modelUsage":{},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"bc1fb6bd-7f93-4d8f-89ed-e28f3de6384c"}