List of the most common passwords

Last updated

This is a list of the most common passwords , discovered in various data breaches. Common passwords generally are not recommended on account of low password strength. [1]

Contents

List

NordPass

NordPass a password manager, has released its sixth annual list of the 200 most common passwords, highlighting persistent trends in password selection. [2] The top twenty most frequently used passwords are:

Top 20 most common passwords according to NordPass
RankPassword
1123456
2123456789
312345678
4password
5qwerty123
6qwerty1
7111111
812345
9secret
10123123
11abc123
12password1
13letmein
141q2w3e4r
15monkey
16qwerty
17123qwe
181234
19iloveyou
20123321

SplashData

The Worst Passwords List is an annual list of the 25 most common passwords from each year as produced by internet security firm SplashData. [3] Since 2011, the firm has published the list based on data examined from millions of passwords leaked in data breaches, mostly in North America and Western Europe, over each year. In the 2016 edition, the 25 most common passwords made up more than 10% of the surveyed passwords, with the most common password of 2016, "123456", making up 4%. [4]

Top 25 most common passwords by year according to SplashData
Rank2011 [5] 2012 [6] 2013 [7] 2014 [8] 2015 [9] 2016 [4] 2017 [10] 2018 [11] 2019 [12]
1passwordpassword123456123456123456123456123456123456123456
2123456123456passwordpasswordpasswordpasswordpasswordpassword123456789
312345678123456781234567812345123456781234512345678123456789qwerty
4qwertyabc123qwerty12345678qwerty12345678qwerty12345678password
5abc123qwertyabc123qwerty12345football12345123451234567
6monkeymonkey123456789123456789123456789qwerty12345678911111112345678
71234567letmein1111111234football1234567890letmein123456712345
8letmeindragon1234567baseball123412345671234567sunshineiloveyou
9trustno1111111iloveyoudragon1234567princessfootballqwerty111111
10dragonbaseballadobe123 [a] footballbaseball1234iloveyouiloveyou123123
11baseballiloveyou1231231234567welcomeloginadminprincessabc123
12111111trustno1adminmonkey1234567890welcomewelcomeadminqwerty123
13iloveyou12345671234567890letmeinabc123solomonkeywelcome1q2w3e4r
14mastersunshineletmeinabc123111111abc123login666666admin
15sunshinemasterphotoshop [a] 1111111qaz2wsxadminabc123abc123qwertyuiop
16ashley1231231234mustangdragon121212starwarsfootball654321
17baileywelcomemonkeyaccessmasterflower123123123123555555
18passw0rdshadowshadowshadowmonkeypassw0rddragonmonkeylovely
19shadowashleysunshinemasterletmeindragonpassw0rd6543217777777
20123123football12345michaelloginsunshinemaster !@#$%^&*welcome
21654321jesuspassword1supermanprincessmasterhellocharlie888888
22supermanmichaelprincess696969qwertyuiophottiefreedomaa123456princess
23qazwsxninjaazerty123123sololovemewhateverdonalddragon
24michaelmustangtrustno1batmanpassw0rdzaq1zaq1qazwsxpassword1password1
25Footballpassword1000000trustno1starwarspassword1trustno1qwerty123123qwe

Keeper

Password manager Keeper compiled its own list of the 25 most common passwords in 2016, from 25 million passwords leaked in data breaches that year. [14]

Top 25 most common passwords according to Keeper
Rank2016 [14]
1123456
2123456789
3qwerty
412345678
5111111
61234567890
71234567
8password
9123123
10987654321
11qwertyuiop
12mynoob
13123321
14666666
1518atcskd2w
167777777
171q2w3e4r
18654321
19555555
203rjs1la7qe
21google
221q2w3e4r5t
23123qwe
24zxcvbnm
251q2w3e

National Cyber Security Centre

The National Cyber Security Centre (NCSC) compiled its own list of the 20 most common passwords in 2019, from 100 million passwords leaked in data breaches that year. [15]

Top 20 most common passwords according to NCSC
Rank2019 [15]
1123456
2123456789
3qwerty
4password
51111111
612345678
7abc123
81234567
9password1
1012345
111234567890
12123123
13000000
14Iloveyou
151234
161q2w3e4r5t
17Qwertyuiop
18123
19Monkey
20Dragon

See also

Notes

  1. 1 2 The presence of "adobe123" and "photoshop" on 2013's list was skewed by the large number of Adobe passwords included in the collected data due to a major security breach in 2013 that affected over 48 million Adobe users. [7] [13]

Related Research Articles

<span class="mw-page-title-main">Microsoft Word</span> Word processor

Microsoft Word is a word processing program developed by Microsoft. It was first released on October 25, 1983, under the name Multi-Tool Word for Xenix systems. Subsequent versions were later written for several other platforms including: IBM PCs running DOS (1983), Apple Macintosh running the Classic Mac OS (1985), AT&T UNIX PC (1985), Atari ST (1988), OS/2 (1989), Microsoft Windows (1989), SCO Unix (1990), Handheld PC (1996), Pocket PC (2000), macOS (2001), Web browsers (2010), iOS (2014), and Android (2015).

<span class="mw-page-title-main">Password</span> Text used for user authentication to prove identity

A password, sometimes called a passcode, is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of password-protected services that a typical individual accesses can make memorization of unique passwords for each service impractical. Using the terminology of the NIST Digital Identity Guidelines, the secret is held by a party called the claimant while the party verifying the identity of the claimant is called the verifier. When the claimant successfully demonstrates knowledge of the password to the verifier through an established authentication protocol, the verifier is able to infer the claimant's identity.

The File Transfer Protocol (FTP) is a standard communication protocol used for the transfer of computer files from a server to a client on a computer network. FTP is built on a client–server model architecture using separate control and data connections between the client and the server. FTP users may authenticate themselves with a plain-text sign-in protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it. For secure transmission that protects the username and password, and encrypts the content, FTP is often secured with SSL/TLS (FTPS) or replaced with SSH File Transfer Protocol (SFTP).

In cryptanalysis and computer security, a dictionary attack is an attack using a restricted subset of a keyspace to defeat a cipher or authentication mechanism by trying to determine its decryption key or passphrase, sometimes trying thousands or millions of likely possibilities often obtained from lists of past security breaches.

<span class="mw-page-title-main">Passphrase</span> Sequence of words used to gain access

A passphrase is a sequence of words or other text used to control access to a computer system, program or data. It is similar to a password in usage, but a passphrase is generally longer for added security. Passphrases are often used to control both access to, and the operation of, cryptographic programs and systems, especially those that derive an encryption key from a passphrase. The origin of the term is by analogy with password. The modern concept of passphrases is believed to have been invented by Sigmund N. Porter in 1982.

<span class="mw-page-title-main">Cryptographic hash function</span> Hash function that is suitable for use in cryptography

A cryptographic hash function (CHF) is a hash algorithm that has special properties desirable for a cryptographic application:

<span class="mw-page-title-main">Key derivation function</span> Function that derives secret keys from a secret value

In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys from a secret value such as a master key, a password, or a passphrase using a pseudorandom function. KDFs can be used to stretch keys into longer keys or to obtain keys of a required format, such as converting a group element that is the result of a Diffie–Hellman key exchange into a symmetric key for use with AES. Keyed cryptographic hash functions are popular examples of pseudorandom functions used for key derivation.

In cryptanalysis and computer security, password cracking is the process of guessing passwords protecting a computer system. A common approach is to repeatedly try guesses for the password and to check them against an available cryptographic hash of the password. Another type of approach is password spraying, which is often automated and occurs slowly over time in order to remain undetected, using a list of common passwords.

passwd Tool to change passwords on Unix-like OSes

passwd is a command on Unix, Plan 9, Inferno, and most Unix-like operating systems used to change a user's password. The password entered by the user is run through a key derivation function to create a hashed version of the new password, which is saved. Only the hashed version is stored; the entered password is not saved for security reasons.

An authentication protocol is a type of computer communications protocol or cryptographic protocol specifically designed for transfer of authentication data between two entities. It allows the receiving entity to authenticate the connecting entity as well as authenticate itself to the connecting entity by declaring the type of information needed for authentication as well as syntax. It is the most important layer of protection needed for secure communication within computer networks.

<span class="mw-page-title-main">Autocomplete</span> Computing feature predicting ending to a word a user is typing

Autocomplete, or word completion, is a feature in which an application predicts the rest of a word a user is typing. In Android and iOS smartphones, this is called predictive text. In graphical user interfaces, users can typically press the tab key to accept a suggestion or the down arrow key to accept one of several.

<span class="mw-page-title-main">Security token</span> Device used to gain access to restricted resource

A security token is a peripheral device used to gain access to an electronically restricted resource. The token is used in addition to, or in place of, a password. Examples of security tokens include wireless key cards used to open locked doors, a banking token used as a digital authenticator for signing in to online banking, or signing transactions such as wire transfers.

<span class="mw-page-title-main">Digest access authentication</span> Method of negotiating credentials between web server and browser

Digest access authentication is one of the agreed-upon methods a web server can use to negotiate credentials, such as username or password, with a user's web browser. This can be used to confirm the identity of a user before sending sensitive information, such as online banking transaction history. It applies a hash function to the username and password before sending them over the network. In contrast, basic access authentication uses the easily reversible Base64 encoding instead of hashing, making it non-secure unless used in conjunction with TLS.

A rainbow table is a precomputed table for caching the outputs of a cryptographic hash function, usually for cracking password hashes. Passwords are typically stored not in plain text form, but as hash values. If such a database of hashed passwords falls into the hands of attackers, they can use a precomputed rainbow table to recover the plaintext passwords. A common defense against this attack is to compute the hashes using a key derivation function that adds a "salt" to each password before hashing it, with different passwords receiving different salts, which are stored in plain text along with the hash.

A security hacker or security researcher is someone who explores methods for breaching defenses and exploiting weaknesses in a computer system or network. Hackers may be motivated by a multitude of reasons, such as profit, protest, information gathering, challenge, recreation, or evaluation of a system weaknesses to assist in formulating defenses against potential hackers.

<span class="mw-page-title-main">Password strength</span> Resistance of a password to being guessed

Password strength is a measure of the effectiveness of a password against guessing or brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to guess it correctly. The strength of a password is a function of length, complexity, and unpredictability.

<span class="mw-page-title-main">User (computing)</span> Person who uses a computer or network service

A user is a person who utilizes a computer or network service. A user often has a user account and is identified to the system by a username . Some software products provide services to other systems and have no direct end users.

<span class="mw-page-title-main">Blacklist (computing)</span> Criteria to control computer access

In computing, a blacklist, disallowlist, blocklist, or denylist is a basic access control mechanism that allows through all elements, except those explicitly mentioned. Those items on the list are denied access. The opposite is a whitelist, allowlist, or passlist, in which only items on the list are let through whatever gate is being used. A greylist contains items that are temporarily blocked until an additional step is performed.

In cryptography, a pepper is a secret added to an input such as a password during hashing with a cryptographic hash function. This value differs from a salt in that it is not stored alongside a password hash, but rather the pepper is kept separate in some other medium, such as a Hardware Security Module. Note that the National Institute of Standards and Technology refers to this value as a secret key rather than a pepper. A pepper is similar in concept to a salt or an encryption key. It is like a salt in that it is a randomized value that is added to a password hash, and it is similar to an encryption key in that it should be kept secret.

<span class="mw-page-title-main">Have I Been Pwned?</span> Consumer security website and email alert system

Have I Been Pwned? is a website that allows Internet users to check whether their personal data has been compromised by data breaches. The site has been widely touted as a valuable resource for Internet users wishing to protect their own security and privacy. Have I Been Pwned? was created by security expert Troy Hunt on 4 December 2013.

References

  1. ↑ Titcomb, James (March 23, 2016). "Do you have one of the most common passwords? They're ridiculously easy to guess". The Telegraph. Retrieved May 1, 2017.
  2. ↑ "Top 200 Most Common Passwords". NordPass. Archived from the original on January 30, 2025. Retrieved February 5, 2025.
  3. ↑ Mastroianni, Brian (January 20, 2016). "These were the 25 worst passwords of 2015". CBS News.
  4. 1 2 Bruner, Raisa (January 23, 2017). "The 25 Worst Passwords You Should Never Use". TIME.
  5. ↑ Ho, Erica (November 22, 2011). "The 25 Most Popular (and Worst) Passwords of 2011". TIME.
  6. ↑ Waxman, Olivia B. (October 25, 2012). "The 25 worst passwords of 2012". CNN. Archived from the original on October 31, 2012.
  7. 1 2 Newman, Jared (January 20, 2014). "The 25 worst passwords of 2013: 'password' gets dethroned". PC World .
  8. ↑ Waxman, Olivia (January 20, 2015). "These Are The 25 Worst Passwords of 2014". TIME.
  9. ↑ Chang, Lulu (January 19, 2016). "Wookie mistake: 'starwars' is now one of the world's 25 worst passwords". Digital Trends .
  10. ↑ Korosec, Kirsten (December 19, 2017). "The 25 Most Common Passwords of 2017 Include 'Star Wars'". FORTUNE.
  11. ↑ Ehrenkranz, Melanie (December 13, 2018). "The 25 Most Popular Passwords of 2018 Will Make You Feel Like a Security Genius". Gizmodo.
  12. ↑ Keck, Catie (December 18, 2019). "It's Time to Nervously Mock the 50 Worst Passwords of the Year". Gizmodo.
  13. ↑ Kelly, Heather (January 22, 2014). "'123456' tops list of worst passwords". CNN .
  14. 1 2 McGoogan, Cara (January 16, 2017). "The world's most common passwords revealed: Are you using them?". The Daily Telegraph .
  15. 1 2 "NCSC Reveals List Of World's Most Hacked Passwords". Forbes. Retrieved November 6, 2023.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.