These common passwords could make your email, banking and social accounts easier to hack, new study reveals

 

  • ‘123456’ appears in almost 210 million exposed passwords, making it the most commonly found password in the analysis.
  • ‘Daniel’ is the most commonly used name in passwords, while ‘football’ is the most popular sport, appearing more than 2.6 million times.
  • ‘Superman’ is the most commonly used fictional character, appearing more than 2.1 million times.

 

Businesses are being urged to take a closer look at the passwords staff are using, after new analysis revealed the words, names and number combinations appearing most often in leaked password data. But this is not just a workplace issue; anyone using similar passwords for personal email, banking, shopping or social media accounts could also be putting themselves at risk.

 

Insurance experts at Alan Boswell Group analysed password data from Have I Been Pwned, which contains hundreds of millions of passwords exposed in data breaches, to identify the most common password choices used online.

From names, years and number combinations to sports, football teams, famous figures, fictional characters, animals, plants and everyday objects, these are the passwords people should avoid using.

 

The most-used passwords overall

 

Despite repeated warnings against using simple number combinations, ‘123456’ remains the most common password in the analysis, appearing 209,972,844 times.

‘123456789’ is the second most common, appearing 80,942,123 times, followed by ‘12345678’, which appears 70,382,347 times.

 

 

The most-used names in passwords

 

The name ‘Daniel’ is the most commonly used name in passwords, appearing as an exact password 2,533,375 times.

‘Michael’ follows in second, appearing 2,332,388 times, while ‘Jessica’ ranks third, appearing 1,893,068 times.

Other names including Thomas, Ashley, Anthony, Michelle and Nicole also appear among the most common password choices.

Rank Password Number of times used
1 123456 209,972,844
2 123456789 80,942,123
3 12345678 70,382,347
4 password 52,256,179
5 admin 42,085,691
6 12345 31,033,620
7 qwerty 30,799,395
8 1234 30,272,674
9 1234567 19,842,479
10 1234567890 19,783,628
Rank Password Number of times used
1 Daniel 2,533,375
2 Michael 2,332,388
3 Jessica 1,893,068
4 Thomas 1,841,082
5 Michelle 1,739,541
6 Ashley 1,727,577
7 Jennifer 1,551,347
8 Nicole 1,542,022
9 Alexander 1,511,905
10 Anthony 1,419,164

 

The most-used years in passwords

 

When it comes to years, 2020 is the most commonly used, appearing as an exact password 1,441,965 times.

The year 1990 is second, appearing 712,954 times, while 2021 follows in third, appearing 659,470 times.

Years like 1990, 1994 and 1989 may point to people using birth years or important dates, while more recent years such as 2020, 2021 and 2022 could reflect passwords created for newer accounts, where users simply added the current year to make a password meet security requirements.

Rank Password Number of times used
1 2020 1,441,965
2 1990 712,954
3 2021 659,470
4 2000 541,734
5 2002 531,133
6 2004 529,772
7 2022 504,185
8 1994 504,092
9 1989 500,207
10 2001 494,366

The most-used football teams in passwords

 

The top five football teams used in passwords are Liverpool, Barcelona, Juventus, Chelsea and Arsenal.

Liverpool is the most commonly used team, appearing as an exact password 1,789,470 times, followed by Barcelona, which appears 1,285,484 times.

Rank Password Number of times used
1 Liverpool 1,789,470
2 Barcelona 1,285,484
3 Juventus 1,230,044
4 Chelsea 1,218,040
5 Arsenal 1,066,837
6 Real Madrid 663,833
7 Pittsburgh Steelers 503,219
8 Rangers 478,901
9 Philadelphia Eagles 474,904
10 Dallas Cowboys 418,439

Among sports, ‘football’, ‘baseball’ and ‘soccer’ are the top three most popular sports used in passwords.

‘Football’ appears 2,603,807 times, while ‘baseball’ appears 1,937,815 times and ‘soccer’ appears 1,769,491 times.

Rank Password Number of times used
1 Football 2,603,807
2 Baseball 1,937,815
3 Soccer 1,769,491
4 Basketball 1,200,664
5 Hockey 889,460

The most-used famous names and pop culture references in passwords

 

‘Blink-182’ is the most commonly used famous pop culture-related password, appearing 1,654,660 times.

Metallica follows closely behind, appearing 1,128,022 times. Other common pop culture references include Eminem, Ronaldo, Nirvanaand 50 Cent.

Rank Password Number of times used
1 Blink-182 1,654,660
2 Metallica 1,128,022
3 Eminem 974,001
4 Ronaldo 890,771
5 Nirvana 885,818
6 50 Cent 544,834
7 Einstein 360,155
8 Madonna 338,263
9 Napoleon 336,792
10 The Beatles 288,121

 

The most-used fictional characters in passwords

 

Among fictional characters, ‘Superman’ is the most common password choice, appearing 2,134,813 times.

‘Naruto’ follows in second, appearing 1,643,637 times, while ‘Batman’ ranks third, appearing 1,338,840 times.

Rank Password Number of times used
1 Superman 2,134,813
2 Naruto 1,643,637
3 Batman 1,338,840
4 Tigger 1,309,873
5 Snoopy 1,071,875
6 Spider-Man 1,050,152
7 Mickey 906,561
8 Garfield 674,625
9 SpongeBob 635,263
10 Sasuke 514,391

The most-used animals in passwords

 

Animal-related passwords are also common, with ‘monkey’ appearing as an exact password 3,963,423 times.

‘Butterfly’ follows in second, appearing 1,176,152 times, while ‘chicken’ appears 917,838 times.

Rank Password Number of times used
1 Monkey 3,963,423
2 Butterfly 1,176,152
3 Chicken 917,838
4 Scorpion 802,076
5 Spider 689,357
6 Elephant 670,030
7 Dolphin 590,520
8 Rabbit 498,998
9 Turtle 452,143
10 Tiger 382,084

The most-used plants in passwords

Among plants, fruits and vegetables, ‘orange’ is the most common password choice, appearing 1,127,398 times.

‘Banana’ follows in second, appearing 1,122,955 times, while ‘flower’ ranks third, appearing 1,102,190 times.

Rank Password Number of times used
1 Orange 1,127,398
2 Banana 1,122,955
3 Flower 1,102,190
4 Pepper 1,097,328
5 Jasmine 1,048,559
6 Apple 523,185
7 Cherry 513,544
8 Pumpkin 466,531
9 Willow 445,841
10 Sunflower 426,980

The most-used objects in passwords

Among everyday objects, ‘computer’ is the most common password choice, appearing 2,422,759 times.

‘Diamond’ follows in second, appearing 1,001,879 times, while ‘silver’ ranks third, appearing 881,203 times.

Rank Password Number of times used
1 Computer 2,422,759
2 Diamond 1,001,879
3 Silver 881,203
4 Money 689,384
5 Guitar 612,539
6 Hammer 418,263
7 Home 340,918
8 Rocket 306,376
9 Monitor 241,162
10 Laptop 212,947

Heath Alexander-Bew, personal lines director at Alan Boswell Group, commented on the findings: “Weak passwords can feel like a small issue, but they can cause problems very quickly, whether it is a personal email account or a workplace system. For individuals, it could mean someone accessing shopping accounts, banking apps or social media. For a business, it could open the door to invoices, customer details, internal files or password reset links for other platforms.

“What is worrying about these passwords is that many of them are not really being guessed. They are already sitting in leaked password lists, and criminals can use automated tools to try them across different sites. That is why passwords like ‘123456’, ‘admin’, a football team, a name or a birth year can still be risky, especially when people reuse them across work and personal accounts.

“The financial side of this should not be ignored either. The latest UK Government Cyber Security Breaches Survey found that 43% of businesses identified a cyber breach or attack in the last year, equal to around 612,000 UK businesses. While many incidents cost less, the most serious cases can climb quickly, with the top 5% of businesses reporting at least £4,000 in perceived costs for their most disruptive breach or attack. For medium and large businesses, that figure rises to at least £10,000.

“The safest approach is to stop relying on passwords that feel easy to remember. Businesses should block the most common leaked passwords, use multi-factor authentication and encourage staff to use password managers. Individuals should do the same for their personal accounts, especially email, banking and shopping logins. It is also worth checking recovery details and forwarding rules after changing a password, because if someone has already been inside an account, changing the password alone may not fully solve the problem.”
 

Methodology

 
The study analysed password data from Have I Been Pwned to identify the most common leaked passwords across categories including numbers, names, years, sports, teams, famous figures, fictional characters, animals, plants and objects.

Each ranking is based on how many times each exact password appeared in the dataset.



Brokers Commentary » Commentary » Latest



Leave a Reply