Account Security20 January 2026 · 3 min read

Old habits die hard: 2025's most common passwords were as predictable as ever

Once again the data says something uncomfortable: choosing an eminently crackable password is alive and well.

A glowing sign-in panel on a dark screen, with a generated password shown in the password field. — A generated password looks like this. The most common passwords in the world look like the next image.

“123456” is still the most commonly used password in the world. Two separate analyses of breached credentials put it in first place — one of them covering billions of exposed passwords across 44 countries — and a full quarter of the thousand most-used passwords are made up of nothing but numerals.

It is not a generational habit either. “123456” was the most popular choice among millennials, Generation X and baby boomers alike, and second among Generation Z and the Silent Generation, who preferred “12345”.

“admin” came next, closely followed by “12345678”, “123456789” and “12345”. Convenience is winning, and it is being paid for with personal data, money and, in some cases, reputations.

A ranked table of the ten most common passwords with the number of times each was seen, led by 123456 at more than 21 million. — The ten most-used passwords across 44 countries, by count. The top two are within three percent of each other; third place is less than half of second.

In the United States and the United Kingdom the picture was just as grim, with “admin” taking first place in both. In the US, “password” and “123456” took second and third; in the UK the two simply swapped.

Same old, same old

An easily guessed password is a paper latch on a front door. It offers no resistance at all, and brute-force and credential-stuffing tools make very quick work of weak or reused passwords at scale. If your password appears on either list, change it now — to something strong and unique for that account, and ideally stored in a reputable password manager.

However stubborn the habit, a password is only one barrier between an account and an attacker. Two-factor authentication as a second layer is not optional any more, particularly for anything holding personal identifiable information.

The risks rise sharply in a corporate setting. Weak, obvious or reused passwords expose not only the employee but the organisation, its customers and its partners. In many cases the initial point of entry is neither sophisticated nor new — it is simply a password that should never have been trusted in the first place. The consequences are rarely trivial: financial loss, operational disruption, regulatory scrutiny and long-term reputational damage. That is why technical safeguards and ongoing awareness training have to be run together rather than chosen between.

Meanwhile the technical barrier for an attacker has never been lower. Modern tools test countless combinations of credentials in minutes, so the odds are stacked firmly on their side. And in an ecosystem built on interconnected services and shared identities, the damage from a single account takeover rarely stays contained for long.

Passkeys are becoming commonplace, and many major platforms — Apple, Google and Amazon among them — now offer them as a primary login method.

You may have had a number of resolutions heading into 2026. If your own passwords appear on either list above, improving your account security should be one of them.