Seven years since our first top 200 common passwords list, we’ve witnessed how credential trends have changed — and what has remained the same. Each year, we rediscover people’s tendency to opt for weak passwords that prioritize convenience over security.
However, this year, we decided to ask ourselves: How do different generations treat their password use? From the silent generation to the “zoomers,” we analyzed which passwords are the most common among different user groups. As it turns out, bad password habits are trendy no matter how old you are.
You must log in or register to comment.
Methodology
The Top 200 Most Common Passwords report is the result of a joint effort between NordPass and NordStellar, prepared in collaboration with independent researchers specializing in cybersecurity incidents. Recent public data breaches and dark web repositories were analyzed from September 2024 to September 2025 to identify statistically aggregated data. No personal data was acquired or purchased for this research.
Okay, so how valid is this really if they’re only using those passwords that were hacked?
Always make sure to pick a popular password people, you don’t want your hacker to think you are a special snowflake.
Can’t run the risk of being fingerprinted, privacy and anonymity first!
Looking at the different countries is also funny. The only password I’m not surprised about is
admin, because that’s probably the default for most devices maybe? Unless user changes it manually.But my question is, are these only “hacked” passwords? Because those who are not hacked, you don’t know what passwords they have. So this is a bit of bias here, right?
You didn’t fill in the survey when the password inspector sent you that email? Rude!
Top 3 are still the same from previous years
- 12345
- 123456
- 12345678
It’s official: “123456” has once again claimed the controversial title of the world’s most common password — and one of the weakest. That marks six out of seven years this password has topped our chart
How can I get to Sesame Street?
P@ssw0rd is ahead of Password. Times they are a changin
Most places force you to put a number and a special character in there now, the number of places you can get away with just a word for a password is dwindling
12345
That’s amazing. I’ve got the same combination on my luggage!
All I see is *****
do they account for the circumstances?
most public wifi login pages get: u: [email protected] p: qwerty
from me.
I assume those types of services get breached all the time and no one cares. I think they just want plausible deniability on acceptable use of the wifi.
Damn, doesn’t load for me :/
