The Most Common Passwords, and Why They Keep Winning

Every year, breach analyses turn up the same handful of passwords near the top of the list: variations on 123456, password, qwerty, and simple keyboard patterns. It's tempting to assume this only happens to careless people. In reality, it happens because these passwords are the path of least resistance — and attackers know it.

Why the same passwords keep showing up

Most people choose a password the same way they'd answer a pop quiz: quickly, under mild pressure, reaching for the first thing that satisfies the site's rules. That produces convergent behaviour — different people, unprompted, land on the same small set of "good enough" answers. Add in default passwords that are never changed, and keyboard-pattern passwords that feel more random than they are, and you get the same names appearing at the top of breach dumps year after year, across completely unrelated services.

Why this matters more than it seems to

Attackers exploit this convergence directly. Rather than guessing randomly, cracking tools work through ranked wordlists built from real breach data — the most common passwords first. A password that appears anywhere near the top of these lists can be tried in the first few seconds of an attack, regardless of how long or "complex-looking" it is. Qwerty123! satisfies most complexity rules and is still one of the first guesses any competent attacker's tool will try.

The patterns to specifically avoid

• Sequential characters: 123456, abcdef, qwerty
• A single dictionary word, even capitalised: Sunshine, Dragon
• Word plus year or exclamation mark: Summer2026, Football!
• Names, teams, and brands relevant to the account itself — using the service's own name is surprisingly common
• Anything reused from another account, even if it was strong there

How to check your own passwords

You don't need to guess whether your password is on one of these lists — you can check. Services like Have I Been Pwned's Pwned Passwords tool let you check a password against known breach corpora without ever transmitting the actual password, using a technique called k-anonymity. If a password you're using shows up, replace it immediately, starting with anything reused elsewhere.

The fix is the same as always

Generate rather than invent, make it long, make it unique per site, and store it in a password manager. That single habit removes you from every list above, permanently.