The Most Common Passwords - And Why They Fail in Seconds

Every year, security firms sift through the latest pile of breached credentials and publish a ranking of what they find. And every year, the podium barely moves:

• 123456
• 123456789
• password
• qwerty
• 111111

NordPass's annual studies of leaked credentials have found 123456 at or near #1 across dozens of countries. And admin - The factory default nobody changed - Has surged up the charts in recent years.

These aren't obscure statistical curiosities. They are the literal first guesses of every cracking tool and every automated login bot on the internet. That's why "common" and "instantly compromised" mean the same thing.

What the leak data actually shows

We know what people choose because attackers keep showing us. The pivotal moment was the 2009 RockYou breach, which spilled 32 million passwords stored in plaintext - No cracking required. It gave the world an unfiltered census of human password habits.

The rockyou.txt wordlist built from that breach ships with essentially every password-auditing tool today. Successor compilations circulating on forums have aggregated billions of lines from thousands of later breaches.

Have I Been Pwned's Pwned Passwords service lets you check a password against real breach data. It has catalogued hundreds of millions of unique leaked passwords, with the top entries seen tens of millions of times each. Our password breach check runs against that same database privately, hashing your input in the browser so the password itself never leaves your device.

The composition of the top ranks is remarkably stable across years, countries, and languages:

Note the last row. The "improved" variants people invent to satisfy complexity rules - Capital letter first, 1! last - Are themselves among the most common passwords on Earth. The complexity meter turns green; the attacker's rule engine yawns.

Why common passwords fail in under a second

Quick summary: attackers guess the popular passwords first - And popular means yours.

Password attacks aren't alphabetical searches - They're ordered by probability. Whether it's an offline cracking rig or an online bot, the attacker tries the most likely candidates first. And the most likely candidates are, by definition, the most common passwords.

• Offline cracking: when a site's password database leaks, tools like Hashcat run wordlists before any brute force. A modern GPU computes billions of fast hashes per second, so the entire top-million list is exhausted in well under a second. If your password is qwerty123, it isn't "cracked" so much as simply looked up - By a toolchain of dictionaries, mangling rules, masks, and precomputed tables.
• Password spraying: online, attackers reverse the attack. Instead of many guesses against one account, they try one or two ultra-common passwords (123456, Summer2026!) against thousands of accounts, staying under every rate limit. Any organization has someone using them; sprayers only need that someone.
• Default-credential scanning: bots continuously probe routers, cameras, and admin panels with admin/admin and friends. The reason admin ranks so high in leak data is that it keeps working.

If a password could plausibly appear in a "worst passwords" listicle - Or in any human's head - Assume it takes an attacker zero seconds. The only passwords with real crack times are the ones no human would ever think of.

The patterns underneath the list

Zoom out from individual entries, and the top of every leak ranking is built from a few generators in the human brain:

Laziness under constraint. 123456 exists because a six-character minimum existed. Password1! exists because a complexity rule existed. People satisfy rules with minimum effort, and minimum effort is maximally predictable - The core insight behind NIST's retreat from composition rules.

The keyboard as a muse. qwerty, 1q2w3e4r, zaq12wsx, qazwsx - Spatial walks feel random to the fingers. But they're fully enumerated in cracking tools, which generate keyboard-adjacency candidates programmatically.

Identity and sentiment. Names of partners, kids, pets, and football clubs, plus iloveyou in every language. These also make passwords guessable by someone who knows you - Or by a bot that scraped your public profiles.

Dates. Birth years and anniversaries add four digits an attacker tries by default. The same instinct rules PINs. Analyses of leaked PIN data famously found 1234 accounting for roughly one in ten four-digit PINs, with birth-year 19xx PINs close behind. If a PIN matters, draw it from a PIN generator, not a calendar.

"But it's hashed" doesn't save a common password

A common misconception: if a site hashes passwords, leaks are harmless. In truth, hashing helps exactly in proportion to how uncommon your password is. Attackers hash their wordlists and compare - For a fast, unsalted algorithm they can even use precomputed tables.

You can see the problem yourself. Run 123456 through a SHA-256 generator and you'll get 8d969eef… - The same digest every attacker has had on file for decades. Any digest of any common password is effectively a reverse-lookup entry, hashed or not.

Slow, salted algorithms like bcrypt raise the cost per guess enormously. But no algorithm rescues a password that's among the first thousand tried.

And once your exact password appears in any breach, it graduates onto the lists permanently. Attackers replay leaked email-password pairs across every major site at scale - An attack economy explained in credential stuffing.

That's why a password's history matters as much as its strength, and why a leaked password must be retired everywhere at once. The step-by-step response is in what to do after a data breach.

Getting off the list

The fix costs five minutes:

1. Check the damage. Enter your email at haveibeenpwned.com to see which of your accounts appear in known breaches. You can also test any current password against its Pwned Passwords corpus - It uses a privacy-preserving partial-hash lookup, so the password never leaves your device in full.
2. Estimate honestly. Run your typical password through a password strength meter that checks patterns and dictionaries locally. If it scores as a word-plus-decoration, it's in the lists.
3. Replace with the unguessable. Use a generated random string per account, plus a memorized passphrase for the master secret - The full recipe is in how to create a strong password. Machine-generated passwords never appear on frequency lists at all, because uniform randomness has no favorites. That's the entire argument in how random password generators actually work.

FAQ

What is the most common password in the world?

123456, by a wide margin - In nearly every breach analysis ever published. NordPass's annual studies have found it topping the charts across dozens of countries, appearing millions of times in leaked datasets. 123456789, password, qwerty variants, and admin round out the top ranks.

How fast can a common password be cracked?

Effectively instantly - Under a second. Common passwords sit at the top of the wordlists every cracking tool and login bot tries first, so no meaningful "cracking" happens; the password is simply looked up. Even online, password sprayers try exactly these strings against thousands of accounts per hour.

How do I check if my password has been leaked?

Use Have I Been Pwned. Its Pwned Passwords service checks a password against hundreds of millions of real leaked passwords using a k-anonymity scheme - Only a five-character hash prefix is ever transmitted. If a password appears there even once, treat it as public and replace it everywhere you've used it.

Is a common password okay for accounts I don't care about?

It's riskier than it looks. Throwaway accounts often share an email with important ones, and they get upgraded over time (saved cards, linked logins). Every reused pair feeds credential-stuffing lists that attackers replay against your email and bank. Since generated passwords cost nothing, there's no economy in a weak one.

Why do people still use these passwords in 2026?

Habit, friction, and rules that reward minimum compliance. Complexity requirements produced Password1!; mandatory resets produced Winter2026; default credentials like admin persist because devices ship with them. The durable fix is systemic - Password managers, generated secrets, breached-password screening - Rather than telling humans to be more creative.