Crappiest passwords are most popular

17 Years Ago happygeek 0 305 Views

Ever wondered what the most popular passwords being used are? Ever wondered what the crappiest, most insecure passwords being used are? Hey, you are in luck as it seems the two lists are exactly the same. The What's My Pass 'Top 500 Worst Passwords of All Time' list makes for interesting, if sometimes rather offensive (you have been warned), reading.

So I have stripped out the expletives and compiled the top 20 most popular and crappy passwords to give you something to ponder upon as we approach the end of the year. Just please don't tell me that you use any of these!

123456
password
12345678
1234
12345
dragon
qwerty
696969
mustang
letmein
baseball
master
michael
football
shadow
monkey
abc123
pass
6969
jordan

The only real surprise is that 'sex' does not make the top 500 list at all. The closest variant being sexy at number 44 and then sexsex at 64.

So go on then, do share, what is the crappiest password you have ever stumbled upon? Remember, keep it clean!

cybersecurity

Dani AI

Generated 9 Months Ago

A short expert summary and practical fixes to sit above this thread.

The thread (started by and followed by notes from , , , and others) illustrates a persistent reality: people keep choosing memorable-but-guessable credentials and those choices quickly end up in breach corpuses that attackers reuse. Large, aggregated breach lists and the public “pwned passwords” services make credential-stuffing and offline cracking effective—treat any common or reused password as already compromised. (haveibeenpwned.com)

What to do as an individual: stop trying to invent memorable “clever” mutations and use tools and techniques that scale. Use a reputable password manager to generate and store unique, long credentials; prefer memorable passphrases (NCSC’s “three random words” approach) or long random strings; and enable multi‑factor authentication on high‑value accounts. Don’t paste live, active passwords into unknown sites or untrusted forms—use integrated APIs or your password manager’s breach‑check features instead. (nicybersecuritycentre.gov.uk)

What to do as a system owner or admin: block known-bad passwords and breached values rather than forcing arbitrary complexity rules; permit long passphrases and allow paste; avoid periodic forced resets except on evidence of compromise; implement rate limiting/account lockout and logging to defeat online guessing; and store credentials with modern slow hashes (Argon2id/scrypt/bcrypt as appropriate) with salts and appropriate work factors. These are explicit recommendations in modern guidance. (pages.nist.gov)

Quick checklist (actionable):

Deploy a breached-password blacklist (or integrate Pwned Passwords).
Require unique credentials and promote password managers + 2FA.
Harden storage with Argon2id/scrypt and rotate hashing parameters when needed.
Educate users about hints, reuse, and not exposing passwords in hints or help fields.
When those four items are in place, the kinds of weak choices discussed in this thread become far less risky. (haveibeenpwned.com)

Thinka 40 Posting Whiz

17 Years Ago

I've worked with someone whose password was "london". Unsurprisingly, this was at a company in the City of, you guessed it, London.

kanaku 60 Posting Whiz

17 Years Ago

Sex probably didn't make it because it's too short (the word)...

I haven't encountered someone with an 'easy' password. My friends could be security freaks...

tiger86 16 Posting Pro

17 Years Ago

I have encountered passwords as simple as flower or the persons name and have had to change them and inform the person to keep the server I protect secure.

scru 909 Posting Virtuoso

17 Years Ago

My daniweb password is 12345. I don't see what the big deal is.

Thinka 40 Posting Whiz

17 Years Ago

scru, I don't know how many people who read this blog will be tempted to use that information, but I hope none.

It reminds me of when Jeremy Clarkson posted his account details in the newspaper, and promptly had £500 deducted from his account...

Whabligone 0 Newbie Poster

17 Years Ago

I had a customer who used the trademark on the monitor as their password "syncmaster"

fire_munki 0 Newbie Poster

17 Years Ago

I've found the exact password in the hint section for customers before, very helpful.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.