The most common leaked password is still 123456, which appears 209,972,844 times in the Have I Been Pwned data. Alan Boswell Group, an insurance broker, ranked exact passwords across categories to show what attackers can expect to find in breach lists.
After 123456 come 123456789 (80,942,123 appearances) and 12345678 (70,382,347). The word password is fourth with 52,256,179, and admin is fifth with 42,085,691.
Personal choices follow the same pattern. Daniel is the most used first name, with 2,533,375 appearances as an exact password, ahead of Michael (2,332,388) and Jessica (1,893,068). The most used year is 2020 (1,441,965), then 1990 and 2021. Liverpool is the most common football team at 1,789,470, and football is the most common sport at 2,603,807. Superman leads the fictional characters with 2,134,813, monkey tops the animals with 3,963,423, and computer is the most common object at 2,422,759.
Heath Alexander-Bew, personal lines director at Alan Boswell Group, said the concern is that these passwords are not being guessed one at a time. They already sit in leaked lists, he said, and criminals can run them automatically across sites, which makes reuse between work and personal accounts the main exposure.
He also pointed to the UK Government's Cyber Security Breaches Survey, which found that 43% of businesses, around 612,000, identified a breach or attack in the last year.
His advice to businesses is to block the most common leaked passwords, require multi-factor authentication and encourage staff to use password managers. After changing a password, he added, it is worth checking recovery details and forwarding rules, because an account that has already been entered may stay compromised.
The study ranked exact passwords by how often each appeared in the dataset.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
