The Internet’s 25 Worst Passwords, and What They Say About You

The good news is that “password” is no longer the most-popular password on the Internet, according to the latest report from SplashData. The bad news is that it’s still the second-most common—and “123456” is the first.

At first blush, SplashData’s annual list of the 25 most common passwords—compiled from files posted online in the wake of security breaches—is not the sort of document that instills great faith in the cleverness of the online masses. On the other hand, some password has to be the most popular. Wouldn’t it be weird if it weren’t something really dumb and obvious?

Keep in mind that the report only tells us the popularity of the top 25 passwords relative to one another, not their absolute popularity. It’s conceivable, then, that both “password” and “123456” are less common across the Internet than they were a year ago. In fact, SplashData CEO Morgan Slain confirmed to me via email that the weakest passwords have declined in popularity in recent years—but only slightly. “We keep hoping for steeper declines as people get more educated about the risks of simple passwords (hence the annual list) and as websites start to enforce stronger password policies,” he said.

So in the spirit of educational password-shaming, here’s SplashData’s list of this year’s 25 worst passwords, along with our own expert analysis of what each one says about the sort of person who uses it. If you find one of your own on the list, it would be prudent to promptly re-examine your entire life change it.

  1. 123456
    I can’t be bothered to take even the most basic step to protect my personal information. Seriously, just go ahead and take it.
  2. password
    I failed to understand the question.
  3. 12345678
    I tried “123456,” but the computer said I had to use at least eight characters.
  4. qwerty
    Aren’t I clever? My password is written right there on the keyboard.
  5. abc123
    I’m a fan of the Jackson Five.
  6. 123456789
    I’m a positive-integer maximalist.
  7. 111111
    I managed to find one of the few passwords that’s both easy to crack and hard to remember. (How many 1s was it, again?)
  8. 1234567
    Seven is my lucky number!
  9. iloveyou
    I’m Theodore Twombly.
  10. adobe123
    You may have cracked my Adobe password, hacker, but you’ll never guess my password for Microsoft!
  11. 123123
    Aha! You were expecting 123456, weren’t you.
  12. admin
    I should be fired immediately.
  13. 1234567890
    I have mastered the base-10 numeral system.
  14. letmein
    Might as well let everyone else in, too.
  15. photoshop
    They told me not to use the same password for every program, so…
  16. 1234
    I can’t be bothered to take even the most basic step to protect my personal information, and neither can the people who run this site.
  17. monkey
    I am an actual monkey.
  18. shadow
    I fancy myself quite sneaky.
  19. sunshine
    I cry myself to sleep at night.
  20. 12345
    I cannot be bothered to take even the most basic etc.
  21. password1
    My last password was compromised, so I added a “1” this time for extra security.
  22. princess
    I’m waiting to be swept off my feet by a Nigerian prince.
  23. azerty
    Hey, at least it’s better than qwerty.
  24. trustno1
    It’s not paranoia if they really do keep guessing my password.
  25. 000000
    My day job is coming up with nuclear launch codes

Hot this week

Compliance Alone Leaves You Vulnerable to Attack

Passing compliance audits doesn't prevent breaches. Learn why attackers target compliant organizations and how to build real security beyond checklists.

Your Vulnerability Management Is Broken Because of CVSS Blind Spots

Overreliance on CVSS scores creates vulnerability management blind spots that expose organizations to real risks. Learn how to prioritize based on business context and actual threats instead of arbitrary scores.

Why Perfect Security Is an Illusion and What to Do Instead

Chasing 100% vulnerability elimination creates false security. True protection comes from prioritizing business critical risks, implementing compensating controls, and building incident response resilience.

When Security Automation Creates Dangerous Blind Spots

Over reliance on security automation creates dangerous blind spots. Learn why human oversight remains irreplaceable and practical steps to balance both.

Why Over Trusting Cybersecurity AI Weakens Your Defenses

Over-reliance on AI tools degrades human security skills while creating new vulnerabilities, requiring balanced collaboration between analysts and technology.

Topics

Compliance Alone Leaves You Vulnerable to Attack

Passing compliance audits doesn't prevent breaches. Learn why attackers target compliant organizations and how to build real security beyond checklists.

Your Vulnerability Management Is Broken Because of CVSS Blind Spots

Overreliance on CVSS scores creates vulnerability management blind spots that expose organizations to real risks. Learn how to prioritize based on business context and actual threats instead of arbitrary scores.

Why Perfect Security Is an Illusion and What to Do Instead

Chasing 100% vulnerability elimination creates false security. True protection comes from prioritizing business critical risks, implementing compensating controls, and building incident response resilience.

When Security Automation Creates Dangerous Blind Spots

Over reliance on security automation creates dangerous blind spots. Learn why human oversight remains irreplaceable and practical steps to balance both.

Why Over Trusting Cybersecurity AI Weakens Your Defenses

Over-reliance on AI tools degrades human security skills while creating new vulnerabilities, requiring balanced collaboration between analysts and technology.

When More Security Tools Create More Risk

Adding security tools often increases risk through complexity. Learn how consolidation and staff training create stronger defenses than endless tool accumulation.

Firewalls Create Dangerous False Security and What to Do Instead

Firewalls create dangerous security illusions by focusing exclusively on perimeter defense while attackers exploit internal network vulnerabilities through lateral movement after inevitable breaches occur.

Why Perfect Security Is a Dangerous Illusion

Financial security teams waste resources chasing breach prevention when resilience and rapid recovery deliver better protection. Learn practical steps to shift focus from impossible perfection to manageable containment.
spot_img

Related Articles

Popular Categories