A review of 19 billion passwords reveals people are still bad at them

Your password probably stinks. At least that’s what a new study shows.

Researchers at Cybernews studied more than 19 billion leaked passwords, and of those just 6 percent were identified as unique, meaning they weren’t re-used or duplicated. To make matters worse, the most common passwords are way too simple. Four percent of all passwords studied by Cybernews — meaning roughly 727 million total passwords — included the phrase “1234.” Phrases like “password” and “admin” were also quite common, meaning folks are still relying on pre-set passwords.

“The ‘default password’ problem remains one of the most persistent and dangerous patterns in leaked credential datasets. Entries ‘password’ (56M) and ‘admin’ (53M) reveal that users overwhelmingly rely on simple, predictable defaults,” said Neringa Macijauskaitė, information security researcher at Cybernews, in a statement. “Attackers, too, prioritize them, making these passwords among the least secure.”

The researchers also discovered lots of passwords that relied on names or, funnily enough, curse words. Sixteen million passwords included the F-bomb, for instance.

Studies have show time and again that we suck at creating passwords. As Mashable covered at the end of last year, for instance, a study from NordPass found the most common passwords are wildly simple.

Here were 2024’s top 10 most-used passwords globally, according to NordPass:

1. 123456

2. 123456789

3. 12345678

4. password

5. qwerty123

6. qwerty1

7. 111111

8. 12345

9. secret

10. 123123

So if you read this article and it seemed…a little too familiar, perhaps it’s time to update your passwords. At the very least, don’t use “123456.”