The Worst Passwords People Still Use

The same passwords appear at the top of breach data year after year. None of them are surprising — they reflect how people actually think about passwords when left to their own judgment. Understanding the patterns reveals why predictability is the real vulnerability, not password length or character rules per se.

Numerical sequences and keyboard patterns

Numerical sequences — 123456, 12345678, 1234567890, 111111 — consistently rank at the top of breach frequency lists. They are used because they are fast to type, easy to remember, and people underestimate how many other people are doing the same thing. These are not passwords; they are the digital equivalent of a door with no lock.

Keyboard patterns are in the same category: qwerty, qwerty123, asdfgh, zxcvbn. These are typed in a straight line across the keyboard — easy to remember through muscle memory but trivially obvious to any attacker. The first-row pattern alone generates dozens of variants that appear in every wordlist.

The problem with these passwords is not that any individual might use them — it is that hundreds of millions of accounts use them. Credential stuffing campaigns and dictionary attacks reach these accounts in milliseconds.

Dictionary words and names

Single dictionary words — password, monkey, dragon, sunshine, princess — appear frequently in breach data. The popularity of specific words shifts over time as cultural references change, but common nouns, positive adjectives, and animal names are perennially overrepresented.

Names — first names, surnames, pet names, team names — follow the same pattern. michael, jessica, charlie, liverpool. These are easy to remember because they are personally meaningful. They are also exactly the thing targeted by social engineering and by personalised attack lists that include names associated with a victim's social media presence.

The "complex" password that is not complex

This category reveals the gap between perceived and actual security most starkly. Password1, P@ssw0rd, Qwerty123! — these appear complex. They contain uppercase letters, numbers, and symbols. They would pass the complexity requirements of most systems. They are not secure.

They are not secure because they are predictable structures applied to predictable base words. Every password-cracking ruleset generates these variants automatically. P@ssw0rd is the word "password" with the most common letter substitutions applied. It is tried within seconds by any serious cracking tool. Its apparent complexity provides no practical protection — it is security theatre.

The same applies to Summer2024!, London2024, Welcome1, and any similar pattern: a capitalised word, a year or number, an optional symbol. This three-part structure is known, common, and attacked.

Personal information as passwords

Birthdates, phone numbers, postcodes, and combinations of personal information make up a significant proportion of cracked passwords in targeted attacks. These are easy to remember because they are already memorised for other reasons — but they are findable. A person's date of birth is often public or semi-public information; their phone number may be obtainable through social engineering; their postcode may be on a profile somewhere.

The particular danger here is targeted attacks: an attacker who has basic information about a specific person will try personal-information-based passwords early and methodically. Mass attacks do not bother with this, but someone specifically targeting you will.

Minor variations on previous passwords

When systems force password changes, users often produce minor variations: Password1 to Password2, or Spring2023! to Summer2023!. Attackers anticipate this. When one password from a person's account history is known, increment and seasonal-rotation patterns are applied automatically. The variation feels different to the user but is trivially related for an attacker with the previous password.

What all of these have in common

Every category of weak password shares one property: predictability. The attacker does not need to try every possible password; they only need to try passwords that people actually use. And people use passwords that are easy to remember, which means passwords that follow human patterns — sequential, meaningful, related to something personal, structurally regular.

The defence is removing human judgment from the process. A randomly generated password is unpredictable precisely because no person chose it. There is nothing to intuit, nothing to pattern-match, nothing to personalise. An attacker trying to crack it has no starting point other than systematic enumeration — which, at sufficient length, is computationally infeasible.

Context matters

It is worth noting that the threshold for "bad" depends on context. A weak password on a forum account for a hobby you use under a pseudonym, with no payment information attached, carries much lower risk than the same password on your email provider, bank, or password manager. The risk from a compromised password scales with what it protects.

This does not mean weak passwords are acceptable even for low-stakes accounts. A compromised low-stakes account can still be used for spam, reputation damage, or — if you have reused the password — as an entry point to higher-stakes accounts through credential stuffing. Unique, strong passwords everywhere is the goal; the tools to achieve this are available for free.