Where This Data Comes From
The most comprehensive password breach datasets come from security researchers aggregating leaked credential databases. Troy Hunt's HaveIBeenPwned contains over 15 billion compromised accounts. NordPass, Specops, and other security vendors publish annual analyses of breached password databases they acquire and de-identify for research purposes.
These databases come from thousands of breaches — from major platforms affecting hundreds of millions of users down to small forums with thousands of accounts. When researchers look at which passwords appear most frequently, they're examining a genuinely representative sample of how real people, across different countries and demographics, actually choose passwords.
The picture that emerges is consistent: a small number of patterns account for a disproportionately large fraction of accounts. Attackers know this and exploit it systematically.
The Top Most Commonly Hacked Passwords
These passwords appear at the top of breach databases year after year. Any account using one of these is cracked within seconds — no sophisticated attack required:
| Rank | Password | Time to crack | Why it's chosen |
|---|---|---|---|
| 1 | 123456 | < 1 second | Keyboard sequence, meets minimum requirements |
| 2 | password | < 1 second | The word for the thing being created |
| 3 | 123456789 | < 1 second | Extended keyboard sequence |
| 4 | qwerty | < 1 second | Top row of keyboard, left to right |
| 5 | 111111 | < 1 second | Simple repetition, easy to type |
| 6 | abc123 | < 1 second | Letters then numbers, meets complexity rules |
| 7 | password1 | < 1 second | Word + number satisfies many systems |
| 8 | iloveyou | < 1 second | Emotionally memorable phrase |
| 9 | 123123 | < 1 second | Repeated sequence |
| 10 | admin | < 1 second | Default for admin accounts everywhere |
| 11 | letmein | < 1 second | Describes the purpose of a password |
| 12 | qwerty123 | < 1 second | Keyboard row + numbers |
| 13 | monkey | < 1 second | No apparent logic — just extremely common |
| 14 | dragon | < 1 second | Fantasy, gaming culture crossover |
| 15 | master | < 1 second | Implies authority, power — psychologically appealing |
Why Humans Keep Choosing These Passwords
Password choice isn't random — it's shaped by predictable cognitive patterns. Understanding these patterns explains why bad passwords are so common and why telling people to "choose a strong password" fails without better tools.
Cognitive Load Minimization
Creating and remembering a password is cognitive work. Under cognitive load — signing up for a new account while distracted, in a hurry, or managing many tasks — people default to the path of least resistance. Keyboard sequences (123456, qwerty) and single common words require virtually no thought. When the cost of a bad choice feels abstract and distant, minimum-effort wins.
The Compliance Trap
Many sites enforce complexity rules: "must contain uppercase, lowercase, number, and symbol." These rules were designed to increase password strength but frequently backfire. "Password1!" satisfies most complexity requirements while being trivially predictable — it appears in every password cracking dictionary. Forced complexity requirements without length requirements produce passwords that look complex but aren't.
The Memorability Illusion
People believe they need to remember their passwords, so they choose memorable ones. But the memorable choices — birthdays, names, sports teams, favorite movies — are the same choices millions of other people make. "Iloveyou" seems personal and unique to the person choosing it. In reality, it appears millions of times in breach databases because it's personally meaningful to a large fraction of the population.
Default and Legacy Credentials
"Admin", "administrator", "root", and "guest" appear frequently not because users choose them deliberately but because they're the defaults for routers, servers, and software systems that were never changed. Attackers scanning the internet routinely try default credentials on every discovered system — it's one of the most successful automated attack vectors.
How Attackers Use These Lists
Understanding the attack isn't just academic — it illustrates why common passwords are so dangerous in practice.
In a dictionary attack, the attacker feeds every known common password through a cracking tool targeting a stolen hash database. The most common 1,000 passwords crack 4-8% of all accounts in any given breach. With millions of accounts in a breach, that's hundreds of thousands of cracked accounts for minimal effort.
In a credential stuffing attack, attackers take credentials from one breach and systematically test them against dozens of other platforms. Because password reuse is so common, even a small percentage of successful logins across Amazon, Gmail, and banking platforms represent thousands of valuable compromised accounts.
In an online brute force attack against login forms, attackers test the top 100 most common passwords against accounts. Even with rate limiting and account lockouts, automated tools can attempt these against millions of accounts simultaneously. The success rate against poorly-secured services is consistently high.
Patterns That Seem Clever But Aren't
Beyond the obvious entries in common password lists, several broader patterns appear frequently enough to be named and targeted specifically:
Year appended to a word
"Summer2024", "Password2023!", "MyPass2025"
Attackers generate these automatically using word + year combinations. Adding the current year to a common word provides almost no security increase.
Leet speak substitutions
"P@ssw0rd", "S3cur1ty!", "H@ck3r"
Dictionary attack rulesets apply these substitutions to every word automatically. They've been built into cracking tools since the early 2000s and provide zero meaningful protection.
Base word + site name
"Google123", "Facebook!2024", "AmazonPass"
If you use site-specific passwords like this across multiple accounts, cracking one reveals the pattern for all others. This is explicitly targeted in credential stuffing attacks.
Keyboard walks
"qwerty", "1q2w3e4r", "qazwsx", "zxcvbn"
Every keyboard pattern is in every cracking dictionary. They take under a second to crack regardless of length.
What You Should Use Instead
The most reliable solution doesn't require you to become better at inventing passwords — it removes the need to invent them at all.
A random password generator produces sequences like "K#9mPqR2@vLxN5sT" — no dictionary word, no pattern, no keyboard sequence. Every character is genuinely random. These passwords are immune to dictionary attacks, leet speak rules, and keyword + year patterns because they contain none of the exploitable structure that makes common passwords weak.
A password manager stores these random passwords so you never need to remember them or type them manually. You maintain one strong master password (use the passphrase method — four or more random words) and the manager handles everything else.
The combination of random generation plus a password manager makes the entire "common password" problem irrelevant — you're no longer choosing passwords based on human psychology, so human-pattern attacks don't apply.
Quick Checklist: Is Your Password on a Common List?
- □ Does it contain a dictionary word? (Any language)
- □ Does it contain your name, birthday, or other personal information?
- □ Is it a keyboard sequence (qwerty, 123456, 1q2w3e)?
- □ Is it fewer than 12 characters?
- □ Does it rely on leet speak (@ for a, 0 for o)?
- □ Is it a common word with a year appended?
- □ Are you using this same password on more than one site?
If you checked any box: generate a replacement password now and store it in a password manager.