Popular Passwords List & Why They’re Weak

The most popular passwords are the easiest to guess, with “123456,” “password,” and “123456789” consistently topping global lists year after year. This article lists the most common passwords, explains why they are so easily cracked, and shows you how to build a stronger one.

Why These Passwords Are So Common

People choose easy-to-remember passwords because they have many accounts and fear forgetting them. Common patterns include:

Sequential numbers: 123456, 123456789, 12345678
The word “password” itself, sometimes with a number appended
Keyboard patterns: qwerty, asdf, 1q2w3e4r
Names, sports teams, or simple words
Repeated digits: 111111, 000000

These are the first things an attacker tries in a “dictionary attack.”

How Attackers Use This List

Cybercriminals use automated tools that test millions of passwords per second. They start with a list of the most common passwords, then move to dictionary words, then variations. This is called a brute-force attack or a dictionary attack. If your password is on the popular list, it will be found almost instantly, regardless of how long it is.

How to Choose a Strong Password

A strong password is long, random, and unique. Follow these steps:

Use at least 12 characters, ideally more.
Mix uppercase and lowercase letters, numbers, and symbols.
Avoid using personal information like your name, birthdate, or pet’s name.
Do not reuse passwords across different accounts.
Consider using a passphrase: a string of random words (e.g., “correct horse battery staple”).

The best way to manage strong passwords is to use a password manager, which generates and stores random passwords for you.

Common Problems with Popular Passwords

The biggest problem is that they are predictable. Even adding a number or a symbol (like “password1” or “Password!”) does not help because attackers know these variations. Another issue is that people often use the same weak password for multiple accounts, so one breach compromises everything.

Comparison: Popular vs. Strong Passwords

Let’s compare how long it would take to crack each at 1 billion guesses per second:

“123456” – cracked instantly (first guess)
“password” – cracked in under a second
“Tr0ub4dor&3” – a common “clever” password, cracked in about 3 hours
“correct horse battery staple” – would take billions of years

Length and randomness matter far more than complexity rules.

Safety and Best Practices

Even with a strong password, you should enable two-factor authentication (2FA) wherever possible. This adds a second layer of security, so even if your password is stolen, the attacker cannot get in without the second factor. Also, regularly check if your email or accounts have been involved in a data breach using services like Have I Been Pwned.

Frequently Asked Questions

What is the #1 most popular password?

According to multiple annual reports, “123456” has been the most common password for years, with over 100 million people using it.

Why do people still use weak passwords?

Because they are easy to remember and many people underestimate the risk. Also, password fatigue—having too many accounts—makes people choose convenience over security.

Is a long password always better?

Generally yes, length is the most important factor. A 12-character random password is far stronger than an 8-character one, even if the 8-character one has symbols and numbers.

Can a password manager be hacked?

Password managers encrypt your data with a master password and strong encryption. While no system is 100% safe, they are much safer than reusing weak passwords. Choose a reputable one and enable 2FA.

How often should I change my passwords?

Only change passwords when you suspect a breach, or when a service tells you to. Changing them too often leads to weaker passwords. The important thing is to use a unique, strong password for each account.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →