The most common passwords and why to avoid them

Year after year, analyses of leaked passwords return almost exactly the same list. The order shifts, a new entry appears, but the top has barely moved in over a decade. These are the ones that always show up, why they keep repeating, and the patterns that make them predictable.

The ones that never miss

These appear consistently in counts of passwords exposed in breaches. Every one of them cracks instantly: they sit at the top of every attack dictionary.

#	Password	Pattern
1	`123456`	Number sequence
2	`123456789`	Number sequence
3	`12345678`	Number sequence
4	`password`	Literal word
5	`qwerty`	Keyboard run
6	`12345`	Number sequence
7	`123123`	Repetition
8	`111111`	Repeated character
9	`1234567890`	Number sequence
10	`abc123`	Mixed sequence
11	`1234567`	Number sequence
12	`password1`	Word + number
13	`qwerty123`	Keyboard + number
14	`000000`	Repeated character
15	`iloveyou`	Common phrase
16	`admin`	Default credential
17	`welcome`	Literal word
18	`monkey`	Dictionary word
19	`dragon`	Dictionary word
20	`letmein`	Common phrase

Attack dictionaries have long included the local variants of every language, so the equivalents in your own language are just as exposed as the English ones.

The six patterns that explain everything

The interesting part is not the list but what it reveals. Almost every human-chosen password falls into one of these patterns, and cracking software tries them before resorting to brute force.

1. Keyboard runs

qwerty, asdfgh, 1qaz2wsx. They look random when typed, but they are straight lines or zigzags across the keys. Attack tools know the layout of every keyboard.

2. Word plus a number at the end

The most widespread pattern in the world. London2026, Laura1985, summer23. An attacker does not try millions of combinations: they cross a dictionary with years and finish in seconds.

3. Leet substitutions

Swapping a for @, e for 3, o for 0. P@ssw0rd feels clever and is one of the oldest transformation rules there is. It adds no security: cracking software applies it automatically.

4. Personal details

Birth dates, children's and pets' names, licence plates. All of it tends to be public or guessable, and targeted attacks build custom dictionaries from your social media.

5. Capital at the start, symbol at the end

When a form demands "one uppercase and one symbol", almost everyone does the same thing: capitalise the first letter and add ! at the end. Springtime2026! satisfies every requirement and is still predictable.

6. Reuse

The most serious of all, because it does not depend on the password but on where you use it. An excellent password reused across ten sites is worth exactly what the weakest of those ten is worth. When that site is breached, your password joins the lists and every other account is exposed.

Why "complexity" misleads

Compare these two:

K7#mQ — 5 characters, uppercase, lowercase, a number and a symbol. It satisfies any form requirement. Cracks instantly.
horse-battery-staple-correct-melon-cup — lowercase and hyphens only. Practically infeasible.

Complexity rules inherited from the 2000s push people towards passwords that are short, hard to remember and easy to crack. NIST has recommended the opposite since 2017: favour length, stop forcing periodic changes without cause, and check passwords against known breach lists.

What to do instead

Check whether yours is on the lists. Our checker compares it against billions of leaked credentials, without the password ever leaving your browser.
Generate, do not invent. Any password you come up with has structure. A random generator does not.
Use a passphrase if you need to remember it. The passphrase generator builds combinations that are memorable and highly resistant.
A different password per site, with a password manager to remember them for you.
Turn on two-factor authentication wherever you can. Even if your password leaks, it is not enough to get in.

Want to know how long yours would hold out? We have the full cracking-time table.