Welcome to our Public Beta Site - What does this mean?
Dublin: 13 °C Thursday 24 May, 2012

New study finds the 25 worst internet passwords

Image: Dave Bleasdale via Flickr

Expert tip: choosing “password” as your online password is not a good idea. In fact, unless you’re hoping to be an easy target for hackers, it’s the worst password you can possibly choose.

“Password” ranks first on password management application provider SplashData’s annual list of worst internet passwords, which are ordered by how common they are. (“Passw0rd,” with a numeral zero, isn’t much smarter, ranking 18th on the list.)

The list is somewhat predictable: Sequences of adjacent numbers or letters on the keyboard, such as “qwerty” and “123456,” and popular names, such as  “michael,”  are all common choices. Other common choices, such as “monkey” and “shadow,” are harder to explain.

As some websites have begun to require passwords to include both numbers and letters, it makes sense varied choices, such as “abc123″ and “trustno1,” are popular choices.

SplashData created the rankings based on millions of stolen passwords posted online by hackers. Here is the complete list:

  1. password
  2. 123456
  3. 12345678
  4. qwerty
  5. abc123
  6. monkey
  7. 1234567
  8. letmein
  9. trustno1
  10. dragon
  11. baseball
  12. 111111
  13. iloveyou
  14. master
  15. sunshine
  16. ashley
  17. bailey
  18. passw0rd
  19. shadow
  20. 123123
  21. 654321
  22. superman
  23. qazwsx
  24. michael
  25. football

SplashData CEO Morgan Slain urges businesses and consumers using any password on the list to change them immediately.

“Hackers can easily break into many accounts just by repeatedly trying common passwords,” Slain says. “Even though people are encouraged to select secure, strong passwords, many people continue to choose weak, easy-to-guess ones, placing themselves at risk from fraud and identity theft.”

The company provided some tips for choosing secure passwords in a statement:

  • Vary different types of characters in your passwords; include numbers, letters and special characters when possible.
  • Choose passwords of eight characters or more. Separate short words with spaces or underscores.
  • Don’t use the same password and username combination for multiple websites. Use an online password manager to keep track of your different accounts.

Are these lists helpful? Do you need to rethink any of your password choices? Let us know in the comments

Read Next:

Published with permission from

Business Insider
Business Insider is a business site with strong financial, media and tech focus.

Comments (20 Comments)

  • Colin Tyrrell 20/11/11 #
    Report this comment

    November11

    Reply
  • Alan Mayock 20/11/11 #
    Report this comment

    How did they get all my passwords!!!

    Reply
  • Sarah Lennon 20/11/11 #
    Report this comment

    They’ll never guess mine, password1

    Reply
  • Olga Short 20/11/11 #
    Report this comment

    Thats why you should leave your password blank, send them on a wild goose chase! :)

    Reply
  • conoraleckelly 20/11/11 #
    Report this comment

    My passwords are extremely hard to guess. I mix up numbers and letters, I have a different pw for each site and they are all over 6 characters. — so how do I remember the pw’s not used on a regulate basis? — I have a great app on my phone called eWallet. I reckon it’s one of the best apps I ever purchased.

    Reply
    • MojoRise 20/11/11 #
      Report this comment

      Likewise

    • Conor Reilly 20/11/11 #
      Report this comment

      Is a password storing facility app really any safer? Well make sure you remember the password for that! Make it easy for yourself… Ewallet1 ;-)

    • G. Smith 20/11/11 #
      Report this comment

      get Lastpass for your web browser. Remember one master password and let it worry about all the others. Great app, has mobile clients for smart phones too etc

    • conoraleckelly 20/11/11 #
      Report this comment

      Actually my pw for eWallet is 15 characters long, it’s a complicated pw and I have it 3 years. Touch wood I haven’t forgotten it yet.
      I’m amazed by all the dislikes to my post. Puzzled.

    • Derek Healy 20/11/11 #
      Report this comment

      I think most people might see your efforts as a little anal! but good for you, your well protected……I’m moving back to using phrases as passwords, harder to break and easier remember. The problem I have is that sites have their own criteria for access and when one comes up with a password they like to use, they have to cange it to fit criteria of another site which is a pain in the ass….

    • Ordinary Joe 20/11/11 #
      Report this comment

      Surely that’ as dangerous as writing down your PIN though? What if you are hacked? Then ALL your passwords are in one place.

    • Nialllateshow 21/11/11 #
      Report this comment

      And what’s your password for the app ? What happens if you forget it ;-)) bet it’s password

  • Ashley Killeen 20/11/11 #
    Report this comment

    By an American company… It was Facebook who compiled this report!

    Reply
  • Alan Conroy 20/11/11 #
    Report this comment

    Regarding passwords with 0 & # etc have a look at this http://xkcd.com/936/

    Reply
  • G. Smith 20/11/11 #
    Report this comment

    the likes of Facebook who compiled this should take some responsibility for allowing weak dictionary words and simple variants as passwords. They should enforce a better minimum acceptable password quality

    Reply
  • Conor Farrell 20/11/11 #
    Report this comment

    The thing is that mixing letters and numbers, caps and lower-case, and so on can still be quite ineffective. Sure, it will be tough for a hacker to guess, but hackers don’t guess passwords: computer software is used to run through all combinations at high speed.

    The best thing to do is simply make your password easy to remember, but as long as possible. The longer the password is, the harder it is for a computer to crack it (a short password can be cracked in minutes, a long one can take years, if not decades). Password cracking software will use wordlists, but the generally consist of single words, and not multiple random words put together.

    A humourous explanation of this: http://xkcd.com/936/

    Reply
  • Andrew Perry 20/11/11 #
    Report this comment

    I have a small programme that randomly generates my passwords on a per-site basis with between 8 and 16 characters, lower- and upper-case letters, numbers and special characters. Nothing’s guaranteed to be secure, but at least it’s better than “passw0rd”. Although XKCD has a point.

    Reply
  • Karen O' Mahony 20/11/11 #
    Report this comment

    Monkey or dragon wouldnt even enter my mind as a password!

    Reply

Add New Comment