If you have ever typed 123456 as a password, you are in very large company. Comparitech analysed more than two billion real passwords that leaked on breach forums in 2025 and built a list of the 100 most used. The winner, once again, was 123456. It appeared about 7.6 million times. Second and third place went to 12345678 and 123456789, 'admin' came fourth, and the old classic 'password' was still hanging around in eighth.
It gets worse the further down you look. About a quarter of the top 1,000 passwords were nothing but digits. Nearly four in ten, 38.6% to be exact, contained the string 123. And 65.8% of the passwords on the list were shorter than the 12 characters that security people usually recommend. Even big institutions slip up: TechSpot also noted a report that the Louvre's video surveillance system had used the password 'LOUVRE'.
Why this matters even if you are careful
Most attacks do not involve someone sitting there guessing your password. Software tries the most common passwords first, then simple variations of them, like adding a year or a single digit at the end. And when a password leaks from one website, attackers try the same email and password on other sites, banks and email accounts included. So the real danger is not one weak password. It is a weak password that you also use somewhere else.
What actually makes a password strong
Length beats cleverness. A string of four or five unrelated words is easier to remember than something like P@ssw0rd! and far harder to crack. Swapping an 'a' for an '@' fools nobody, because cracking tools try those swaps early. Modern guidance, including from standards bodies like NIST, leans towards long passwords rather than strange symbol rules.
The second rule is just as important: one password per account. If you reuse the same one everywhere, a single leak opens every door.
A ten-minute fix
- Start with the accounts that matter most: your main email, your bank and anything that can reset other accounts.
- Generate a long, random password with our Password and Hash Generator and save it in a password manager. A browser's built-in manager is not perfect, but it is far better than 123456.
- Turn on two-factor authentication, or passkeys where a site offers them. Even a leaked password is much less useful to an attacker with that switched on.
- Check whether your email address has turned up in a known breach at haveibeenpwned.com, and change any password that did.
That is it. You do not need to change everything in one evening. Do the important accounts today and a few more each week.
New annual password lists tend to come out around this time of year, so it is worth taking a few minutes now to see where your own passwords stand.
General advice only. No password system is completely safe, but these steps remove the easiest ways in. Last updated 4 November 2026.
Source: TechSpot, 'It's nearly 2026 and most people still use 123456 as a password', reporting Comparitech's analysis (https://www.techspot.com/news/110174-nearly-2026-most-people-use-123456-password.html).
