Here Are the Top 10 Passwords for 2024, and They're All Embarrassing

How do so many people get hacked? Apparently, many of them don’t give much thought to choosing their passwords, both for personal and for work accounts. That’s according to the sixth annual analysis of personal password habits from password manager NordPass in collaboration with threat-management software NordStellar.

“Guess what?” the report introduction asks. “(Passwords are) still really bad.”

How bad? Bad enough that you might think Homer Simpson just mashed his hand on a computer keyboard to come up with a password. According to the report, the most popular password in the world for both personal and corporate accounts is 123456, and it’s used by more than 3 million people for personal accounts and more than 1.2 million for corporate ones.

Read more: Best Password Manager of 2024

“‘123456’ has once again claimed the title of the world’s worst password!” the NordPass analysis reports. “In fact, during this our six-year study, it topped the charts as the most common password 5 out of 6 times. ‘Password’  held this not-so-noble title just once.”

Here are the top five passwords for personal accounts, according to the analysis.

1. 123456
2. 123456789
3. 12345678
4. password
5. qwerty123

And here are the top five for corporate accounts.

1. 123456
2. 123456789
3. 12345678
4. secret
5. password

According to the report, it takes less than a second to crack any of these 10 passwords.

The company reviewed and analyzed a 2.5TB database extracted from public sources, including those on the dark web. Data was organized by country of origin, covering 44 countries, and was separated by corporate and personal credentials by the use of related email addresses.

Tips for stronger passwords include making a lengthy password that steers clear of easily guessed information, such as birthdays, names and common words. Users should not reuse passwords for different sites. Password managers can also protect passwords without requiring the user to memorize dozens of complex passwords, since they will only need one password to log into the password manager itself.