Common Passwords Might Surprise You

Yes, common passwords are far weaker and more predictable than most people assume—the same short strings like “123456” and “password” appear in millions of accounts every year. This article explains why these passwords persist, how attackers use them, and how to choose a genuinely strong alternative.

Formula

The calculator above works out how many password guesses an attacker can make in a given time, and converts that time into hours and days. The formula is simple: Total guesses = time (seconds) × guesses per second. For example, if an attacker can try 1 billion passwords per second, in 1 second they make 1,000,000,000 guesses. The “Equivalent hours” and “Equivalent days” outputs just convert the input seconds into larger units so you can grasp the scale.

Worked Example

Using the default values: time = 1 second, guesses per second = 1,000,000,000.

• Total guesses = 1 × 1,000,000,000 = 1,000,000,000
• Equivalent hours = 1 / 3600 = 0.0003 hours
• Equivalent days = 1 / 86400 = 0.00001 days

So in one second, an attacker makes one billion guesses—enough to try every password in the top 10,000 common list many times over.

Why Common Passwords Persist

People choose weak passwords for the same reasons they always have: they are easy to remember, quick to type, and feel “good enough” until something goes wrong. The most common passwords in data breaches year after year are:

• 123456
• password
• 123456789
• 12345678
• qwerty
• 12345
• letmein
• admin

These appear in millions of leaked credentials because they are the first thing a person thinks of, and many people reuse them across multiple sites. A 2023 analysis of over 15 billion breached passwords found that “123456” alone appeared more than 100 million times.

How Attackers Use Common Passwords

Attackers do not sit and guess one password at a time. They use automated tools that try thousands of passwords per second against many accounts at once. The main techniques are:

• Dictionary attacks: trying a list of common words, names, and simple variations.
• Brute force: trying every possible combination of characters, usually for short lengths.
• Credential stuffing: taking username/password pairs from one breach and trying them on other sites.
• Rainbow tables: precomputed hash tables that instantly reverse simple password hashes.

For a password like “123456”, a dictionary attack finds it in the first few guesses. Even a longer but predictable password like “password123” or “qwerty123” is in most wordlists. The speed of modern hardware means even an 8-character lowercase password can be cracked in minutes or hours, depending on the attacker’s resources.

What Makes a Password Strong

Strength comes from two things: length and unpredictability. A password with 12 random characters from all four character types (uppercase, lowercase, digits, symbols) has vastly more combinations than an 8-character one. For example:

• 8 lowercase letters: 26^8 ≈ 2×10^11 combinations
• 12 lowercase letters: 26^12 ≈ 9×10^16 combinations
• 12 mixed characters: 94^12 ≈ 4×10^23 combinations

The practical rule is: the longer the better. A passphrase like “correct horse battery staple” (four random words) is both memorable and strong because it is long and not in any wordlist. Randomness matters more than complexity—a 12-character random string is far harder to guess than “P@ssw0rd123” which follows a known pattern.

Common Mistakes and Misconceptions

Many people believe that adding a symbol or capital letter makes a password secure. In reality, attackers know these patterns. “Password1!” is weak because it is a common word with predictable substitutions. Other common mistakes include:

• Using personal information like birthdays, names, or pet names
• Reusing the same password across multiple accounts
• Writing passwords on sticky notes or in plain text files
• Choosing short passwords even with complex characters
• Using keyboard patterns like “qwerty” or “asdfgh”

A common misconception is that changing passwords frequently makes you safer. Current guidance from security experts suggests that frequent forced changes can lead to weaker passwords, as people tend to make small variations. Instead, focus on unique, long passphrases for each account.

How to Choose a Strong Password

Here is a practical method that balances security and memorability:

1. Pick four random words that are not a common phrase (e.g., “blue umbrella rocket winter”).
2. Add a number and a symbol in a non-obvious place (e.g., “Blue!umbrella9rocket-winter”).
3. Use a different passphrase for each important account (email, banking, social media).
4. Enable two-factor authentication wherever possible—it adds a second layer even if your password is compromised.
5. Consider a password manager to generate and store unique passwords for every site.

If you must write a password down, keep it in a locked drawer or a secure note app, not on a sticky note on your monitor.

Comparing Password Managers vs. Memory

Password managers (like Bitwarden, 1Password, or KeePass) generate and store strong random passwords for each site. They are generally safer than trying to remember dozens of unique passwords. The main risk is a master password—make that one long and memorable. If you prefer not to use a manager, at least use a passphrase system for your most critical accounts. The trade-off is that a manager is a single point of failure if your master password is weak, but it is still better than reusing the same password everywhere.

Safety and Limits

No password is unbreakable given enough time and computing power. The goal is to make cracking your password so expensive that an attacker moves on. For online accounts, most services limit login attempts, which slows brute force. But if a database is stolen, attackers can crack hashes offline at high speed. That is why length and randomness matter. Also, never share your password with anyone, and be wary of phishing emails that ask for credentials—even the strongest password is useless if you type it into a fake site.

Frequently Asked Questions

What is the most common password in the world?

According to multiple breach analyses, “123456” is consistently the most common password, appearing in over 100 million leaked accounts. The second most common is usually “password” or “123456789”.

Why do people still use “password” as their password?

It is easy to remember and type, and many people underestimate the likelihood of being targeted. They also assume that because their account has never been hacked, it never will be. This is a false sense of security.

Is a longer password always better than a complex one?

Yes, in most cases. Length exponentially increases the number of possible combinations, while complexity (adding symbols) only increases it linearly. A 16-character lowercase passphrase is stronger than an 8-character password with symbols.

How fast can a computer crack a common password?

With a modern GPU and a leaked hash, a password like “123456” is cracked instantly—within milliseconds. Even an 8-character lowercase password can be cracked in under an hour with a good wordlist and a fast machine.

Should I change my passwords regularly?

Only if you suspect a breach or have shared the password. Frequent forced changes often lead to weaker passwords. Instead, focus on making each password unique and long.

What is a passphrase and why is it recommended?

A passphrase is a sequence of random words, like “correct horse battery staple”. It is longer than a typical password, making it exponentially harder to crack, yet easier to remember because it forms a mental image. Security experts like those at the UK’s NCSC recommend this approach.

Related

• Best RTS Games: Top Picks for Every Kind of Player
• Is 9anime.vc Safe? Risks, Legality, and Safer Options
• Best Games Releasing in August 2026

in t | Time to crack (seconds) | - | 1 | 0 | 31536000
in r | Guesses per second | - | 1000000000 | 1 | 1000000000000
out attempts | Total guesses | - | t * r | 0
out hours | Equivalent hours | h | t / 3600 | 2
out days | Equivalent days | d | t / 86400 | 2