The 20 Most Common Passwords (NordPass 2025)
NordPass, a password manager, publishes an annual list of the 200 most common passwords. The 2025 top 20 below is copied from the compilation on Wikipedia: List of the most common passwords. The counts are the number of times each password appeared in NordPass's data. The sample size and exact method are not stated in that compilation, so treat the counts as a ranking guide, not a precise measure.
| Rank | Password | Times seen | What it is |
|---|---|---|---|
| 1 | 123456 | 21,627,656 | A simple number sequence |
| 2 | admin | 21,030,012 | A default account word |
| 3 | 12345678 | 8,274,408 | A number sequence |
| 4 | 123456789 | 5,673,712 | A number sequence |
| 5 | 12345 | 3,950,777 | A number sequence |
| 6 | password | 3,545,119 | The word itself |
| 7 | Aa123456 | 2,520,728 | A sequence with a capital and lowercase letter added |
| 8 | 1234567890 | 1,418,939 | A number sequence |
| 9 | Pass@123 | 1,210,039 | A predictable symbol-and-digit pattern |
| 10 | admin123 | 1,087,247 | A default word plus digits |
| 11 | 1234567 | 1,084,354 | A number sequence |
| 12 | 123123 | 1,060,563 | A repeated three-digit block |
| 13 | 111111 | 990,391 | One repeated digit |
| 14 | 12345678910 | 988,396 | A number sequence |
| 15 | P@ssw0rd | 770,658 | The word password with predictable substitutions |
| 16 | Password | 755,709 | The word itself with a capital |
| 17 | Aa@123456 | 735,141 | A sequence dressed up with letters and a symbol |
| 18 | admintelecom | 585,620 | A default word plus a name |
| 19 | Admin@123 | 579,512 | A default word with a predictable pattern |
| 20 | 112233 | 576,908 | Repeated digit pairs |
Do not use any password in this table, or a variation of it. They are shown only so you can recognise the patterns.
How the Top 10 Compares Across Other Lists
Different organisations measure different data, so their rankings differ. Even so, the same handful of passwords appear again and again, years apart. This table compares the top 10 from three other published lists.
| Rank | NCSC / Have I Been Pwned (2019) | SplashData (2019) | Huntress (2026) |
|---|---|---|---|
| 1 | 123456 | 123456 | 123456 |
| 2 | 123456789 | 123456789 | 123456789 |
| 3 | qwerty | qwerty | 12345678 |
| 4 | password | password | password |
| 5 | 1111111 | 1234567 | qwerty123 |
| 6 | 12345678 | 12345678 | qwerty1 |
| 7 | abc123 | 12345 | 111111 |
| 8 | 1234567 | iloveyou | 12345 |
| 9 | password1 | 111111 | secret |
| 10 | 12345 | 123123 | 123123 |
The NCSC list covers the top 100,000 passwords found in data breaches as of 2019, compiled by Troy Hunt of Have I Been Pwned. SplashData's list is based on millions of leaked passwords. The Huntress list does not describe its method in the compilation we used.
Patterns That Make a Password Common
- Number sequences and repeats: 123456, 12345678, 111111 and 112233 are the easiest passwords to guess.
- Keyboard walks: qwerty, qwerty123 and 1q2w3e4r follow the layout of the keyboard instead of any hidden meaning.
- Default words: admin, password and secret are the first things anyone tries on a new account or device.
- Predictable decoration: Aa123456, Pass@123, P@ssw0rd and Admin@123 add capitals, symbols or digits to a common word or sequence, and the decoration itself follows a pattern attackers already know.
- Emotional words and names: iloveyou, dragon and monkey appear on several lists, because people choose words that matter to them.
Why "Looks Complex" Is Not the Same as Strong
A password like P@ssw0rd satisfies many website rules: eight characters, a capital letter, a digit and a symbol. On paper it has a large search space. In practice, attackers do not search every combination. They try known passwords and their common variations first, so a password that appears in leak lists falls almost immediately, whatever its length or symbols.
That is why the crack-time table applies only to truly random passwords, and why a password's theoretical entropy overstates the strength of anything a person invented. For the details of how modern password rules treat this problem, see our summary of the NIST password guidelines, which require services to check new passwords against a blocklist of known weak ones.
How Attackers Use These Lists
- Credential stuffing tries username and password pairs leaked from one site against other sites, relying on people reusing passwords.
- Password spraying tries a few very common passwords against many accounts, so no single account sees enough failures to lock.
- Dictionary attacks work through lists of common passwords and their variations before trying anything else.
What to Do About It
- Check what you use. Test a password you suspect is weak with our Password Strength Checker. You can also check whether a password has appeared in known breaches with the Pwned Passwords service at haveibeenpwned.com/Passwords. Never type a password you still use into a site you do not trust.
- Replace it with a random one. Generate a long random password with the Strong Password Generator or the 16 Character Password Generator.
- Use a different password on every account, so one leak cannot open the others.
- Change default passwords on routers, cameras and other devices. The word admin is the second most common password on the NordPass list for a reason.
- Turn on two-factor authentication and use passkeys where a service offers them.
Sources
- Wikipedia: List of the most common passwords, the compilation of NordPass (2025), SplashData (2019), NCSC/Have I Been Pwned (2019), Keeper (2016) and Huntress (2026) lists. Figures were read from this page on 7 October 2026; check NordPass's own report for the original data.
- Have I Been Pwned, the breach-notification service and Pwned Passwords checker.