Seven years since our first top 200 common passwords list, we’ve witnessed how credential trends have changed — and what has remained the same. Each year, we rediscover people’s tendency to opt for weak passwords that prioritize convenience over security.

However, this year, we decided to ask ourselves: How do different generations treat their password use? From the silent generation to the “zoomers,” we analyzed which passwords are the most common among different user groups. As it turns out, bad password habits are trendy no matter how old you are.

all 33 comments

sorted by: hot top controversial new old
[–] 25 points 11 months ago

Always make sure to pick a popular password people, you don't want your hacker to think you are a special snowflake.

  • source
  • [–] 16 points 11 months ago (3 children)

    P@ssw0rd is ahead of Password. Times they are a changin

  • source
  • hideshow 3 child comments
  • [–] 16 points 11 months ago*

    Am I unreasonably disappointed to not find “Correct Horse Battery Staple” - or some variation thereof - in that list?

  • source
  • [–] 15 points 11 months ago (5 children)

    Top 3 are still the same from previous years

    1. 12345
    2. 123456
    3. 12345678

    It’s official: “123456” has once again claimed the controversial title of the world’s most common password — and one of the weakest. That marks six out of seven years this password has topped our chart

  • source
  • hideshow 5 child comments
  • [–] 13 points 11 months ago (4 children)

    Looking at the different countries is also funny. The only password I'm not surprised about is admin, because that's probably the default for most devices maybe? Unless user changes it manually.

    But my question is, are these only "hacked" passwords? Because those who are not hacked, you don't know what passwords they have. So this is a bit of bias here, right?

  • source
  • hideshow 4 child comments
  • [–] 7 points 11 months ago (2 children)

    But my question is, are these only “hacked” passwords? Because those who are not hacked, you don’t know what passwords they have. So this is a bit of bias here, right?

    No, that's not how these are obtained. Password dumps are from attackers breaching a site's user database and dumping their credentials, usually by phishing administrators' logins. Attackers are brute-forcing passwords anymore except on a one-off, very rare basis. Here's a list of publicly-known password dumps, and you can see details about where they came from: https://haveibeenpwned.com/PwnedWebsites

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 11 months ago (1 child)

    Ah right, that makes sense. I know that site, but didn't think of. I know not the smartes in the town.^^

    I also wonder if people do more secure passwords for important services. Or do they treat it the same? My parents always used their birthday as password, so they do not forget it. Which not much more secure than 1234.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 11 months ago

    I also wonder if people do more secure passwords for important services.

    In my experience, most people have at most 2-3 passwords, and some do choose a "more secure" one for things like banking and work. Very few people use a password manager.

  • source
  • parent
  • [–] 5 points 11 months ago

    Thankfully this isn't allowed for new devices being sold in the EU anymore. They are required to have a per-device individual password now. Hopefully this effectively causes the practice to at least become much less common globally. After all, if you've setup the needed manufacturing steps, there's little sense in skipping them depending on a target region.

  • source
  • parent
  • [–] 12 points 11 months ago (1 child)

    12345

    That's amazing. I've got the same combination on my luggage!

  • source
  • hideshow 1 child comment
  • [–] 10 points 11 months ago

    Thankfully my password, hunter2, isn't in there.

  • source
  • [–] 8 points 11 months ago

    For the longest time the admin password for the router at work was PasswordReset.124, the useless penetration testers didn't even pick up on it.

    I've changed it to something actually random and then, following established industry standard security practises, somebody else has gone and written it on a post-it note, and stuck it to the router. So we're all fine now.

    I'm extremely tempted to "hack" the network and bring it down only to be the hero that brings it back up after a few hours of non-productivity. But I feel like if they found out that might be a firing offence.

  • source
  • [–] 6 points 11 months ago

    Long passwords are more secure which is why I chose PasswordAdminQwertyAbcdefg1234567890987654321

  • source
  • [–] 4 points 11 months ago (1 child)

    theworldinyourhand

    Really? is that from something?

  • source
  • hideshow 1 child comment
  • [–] 3 points 11 months ago

    do they account for the circumstances?

    most public wifi login pages get: u: abc@def.com p: qwerty

    from me.

    I assume those types of services get breached all the time and no one cares. I think they just want plausible deniability on acceptable use of the wifi.

  • source
  • [–] 4 points 11 months ago

    Damn, doesn't load for me :/

  • source
  • [–] 3 points 11 months ago

    Decided to click on some countries and im pretty sure some of irelands ones are for tv shows.

  • source
  • [–] 3 points 11 months ago* (1 child)

    There was a post on here a while ago about the most popular four digit PIN numbers. I think the top five were

    1234
    7890
    1212
    1111
    And 1701

    We're are all so original

  • source
  • hideshow 1 child comment
  • [–] 2 points 11 months ago (2 children)

    Methodology

    The Top 200 Most Common Passwords report is the result of a joint effort between NordPass and NordStellar, prepared in collaboration with independent researchers specializing in cybersecurity incidents. Recent public data breaches and dark web repositories were analyzed from September 2024 to September 2025 to identify statistically aggregated data. No personal data was acquired or purchased for this research.

    Okay, so how valid is this really if they're only using those passwords that were hacked?

  • source
  • hideshow 2 child comments
  • [–] 9 points 11 months ago (1 child)

    It's very valid. The password dumps they're analyzing aren't based on attackers brute-force, they're based on attackers breaching sites' backends and dumping the user databases. Some of these are sites with millions of records, and when you look at credential-stuffing lists (which are aggregate lists of currently-accessible accounts using previously-breached credential pairs), it adds millions more.

    Sort this list by year, and you can see there's tens of millions of leaked passwords in 2025 alone: https://haveibeenpwned.com/PwnedWebsites

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 11 months ago

    Good news everyone ! "top 200 most common passwords" isn't in the list, so we can keep using that one !

  • source
  • 16 comments in c/technology@lemmy.zip view that post
    [–] 10 points 11 months ago
    [–] 9 points 11 months ago*

    gen z

    nr 7: skibidi

    nr 10: assword

    Sounds about right

  • source
  • [–] 9 points 11 months ago (4 children)
  • [–] 3 points 11 months ago (3 children)
  • [–] 3 points 11 months ago (2 children)

    That's industry speak for lazy

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 11 months ago (1 child)

    Just seems oddly specific. Is this a default password somewhere?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 11 months ago

    It's normally what's used when told to changing from admin/admin. Not for production devices but when testing things out new set ups and such. It's usually something like this or the carrier's name + 123. Once put into production there will be a compliant password generated and stored. Thing with these lists is that networking/IT/telco people may have the default password for several hundred devices saved in their browser or password manager so you get skewed results.

  • source
  • parent
  • [–] 3 points 11 months ago

    I don't know who is jesse kissa, but she seems pretty popular in Finland

  • source
  • [–] 3 points 11 months ago (1 child)

    It's interesting how older generations tend to use names for passwords.

  • source
  • hideshow 1 child comment
  • [–] 2 points 11 months ago (1 child)

    What an infuriating webpage layout. I can only see six passwords before having to scroll.

  • source
  • hideshow 1 child comment