The world’s most common online password is 123456, according to online password management company NordPass
What makes a terrible online password? Something simple, short and predictable.
Astonishingly, those are also the characteristics of the world’s most common online password, which is 123456, according to online password management company NordPass.
NordPass also calls 123456 the worst password, because as well as being used over 4.5 million times, it takes less than a second for hackers to crack – like the rest of the top 20 most popular online passwords.
Here are the other passwords on the list, as well as some advice on how you can improve your passwords to protect yourself from cybercrime.
The world’s most common online passwords
NordPass analysed a vast database of online passwords, then with the help of a team of researchers investigated which ones had been stolen with the use of malware.
This is the list of the top 20 most common passwords. If any of yours are included, it might be time to think about changing them.
1. 123456
2. admin
3. 12345678
4. 123456789
5. 1234
6. 12345
7. password
8. 123
9. Aa123456
10. 1234567890
11. UNKNOWN
12. 1234567
13. 123123
14. 111111
15. Password
16. 12345678910
17. 000000
18. Admin123
19. ********
20. user
This is the fifth year that NordPass has mapped out the world’s password habits. This year’s winner, 123456, has come top three times. It has only been beaten by 12345, which happened in 2019, and by the ever-popular “password”, in 2022.
Here are the 200 most common passwords from 2019-2022.
Password habits vary by platform
This year’s data allows people to explore how password creation differs across digital platforms. It shows that people tend to have different password habits depending on which platform they are using.
People using streaming services tend to choose the worst passwords, which gives an easy opportunity for cybercriminals to breach accounts, NordPass says.
The growth of cybercrime
As digitalization increases, so do people’s chances of being affected by online crime. Nearly nine out of 10 web app attacks use stolen data, and 18% of common items for sale on the dark web are passwords, emails and account data, NordPass says.
Overall, 24 billion different online credentials – such as usernames and passwords – have been stolen since 2016. That’s roughly three for every person on the planet.
All this means the cost of cybercrime is soaring, and is expected to exceed $11 trillion in 2023.
The World Economic Forum’s Partnership Against Cybercrime brings together law enforcement agencies, cybersecurity companies, global corporations and not-for-profit alliances to help combat cybercrime.
How to improve your password
You can check to see if your passwords have been compromised by visiting website services such as HaveIBeenPwned. Just enter your email address and it will tell you if your account has been part of any data breaches.
When choosing a new password, it is better to use complex combinations of lowercase and uppercase letters, numbers and special characters because they take longer to decrypt – unlike the 20 most popular passwords of 2023. Aim for at least 12 characters, although you could go even longer.
It might be tempting to use memorable numbers or words that link back to your life – such as a pet’s name or memorable birthday – but this can also make cracking the password easier.
Using the same password for multiple sites is also not recommended, as if one of those sites becomes compromised, your password across all the other sites is also at risk.
It’s also worth changing your passwords every three months, cybersecurity experts say. “Sometimes you might never be aware that your password for an account was compromised,” online security experts Kaspersky say. “By changing your password every few months, you limit the amount of time a hacker can spend in your account and hopefully minimize the damage a cybercriminal could cause.”
Password managers and passkeys
You could also use a password manager. This is a piece of software that can generate complex passwords for various websites, detect password breaches, and store passwords in an encrypted environment.
Password managers are operated by a single password, meaning you only have to remember one password ever. They keep themselves secure through the use of extra layers of multifactor and biometric authentication.
Another way to boost your online security is with passkeys, a replacement for passwords for businesses or for personal use that combine biometric verification with cryptographic keys.
NordPass says passkeys are “inherently resistant to phishing, brute-force attacks and other cyber threats” and can be used across multiple devices and operating systems. Passkeys also mean you never have to remember a password again.
Author – Ewan Thomson, Senior Writer, Forum Agenda
This article is republished under the creative commons licence
