I could not let 2021 wrap up without the annual look at the OMG WTF are they thinking worst passwords list. I have been covering the sorry-state of passwords since 2010 and unfortunately little has changed. The biggest change has come in the increased number of mega-breaches leaking passwords all over the Intertubes.
Here is NordPass’s 2021 list. Nordpass and independent cybersecurity researchers evaluated a database with 4 terabytes’ worth of data. You can visit the NordPass website to see all 200 of the entries from 2021. But here are the top 25 most common passwords:
2021's Worst Passwords
2021's 25 worst passwords compiled by Nordpass.| Rank | Password | Change from 2020 |
|---|---|---|
| 1 | 123456 | - |
| 2 | 123456789 | - |
| 3 | 12345 | +5 |
| 4 | qwerty | +8 |
| 5 | password | (1) |
| 6 | 12345678 | -+1 |
| 7 | 111111 | (2) |
| 8 | 123123 | (2) |
| 9 | 1234567890 | (1) |
| 10 | 1234567 | +1 |
| 11 | qwerty123 | New |
| 12 | 000000 | +3 |
| 13 | 1q2w3e | New |
| 14 | aa12345678 | New |
| 15 | abc123 | (2) |
| 16 | password1 | +3 |
| 17 | 1234 | (1) |
| 18 | qwertyuiop | +6 |
| 19 | 123321 | +4 |
| 20 | password123 | New |
| 21 | 1q2w3e4r5t | New |
| 22 | iloveyou | (5) |
| 23 | 654321 | +1 |
| 24 | 666666 | New |
| 25 | 987654321 | New |
Bad password factoids
- The top 25 bad passwords can be cracked in less than 1 second by a bot (or person) according to Nordpass.
94% of the most frequent passwords – can be cracked in less than 10 seconds. - The most secure password “myspace1” ranked #54 on the list. It was used by 1,619,027 users and can be cracked in 3 hours.
- The most popular sport on the list is “football.” It ranked #60 and was used by 1,468,381 users.
- “Superman” protected 1,180,436 accounts. He ranked 81st but could be cracked in less than 1 second.
- The most popular movie on the list was “starwars.” 701,474 users tried to use the Force to protect their accounts. Unfortunately the Force is not strong with this one, it could be cracked in less than 1 second.
Password risk index
The NordPass researchers also devised a risk index based on the number of passwords leaked in each country per capita. Russia came in first with an astounding 19.9 passwords leaked per capita. Other counties that leaked the most passwords are:
- The Czech Republic 6.2,
- France 6.0,
- Germany 5.8,
- U.S. 5.2,
- Italy 4.4,
- Canada 3.6,
- Australia3.3
- and Poland 3.6.
rb-
You can test the strength of your password by visiting this site and typing it in. They claim the site isn’t creating a repository of passwords because your information is never sent over an internet connection. The best part? As you type, the software tells you approximately how long it would take a computer to figure out your password. The site turns red if your password is weak but slowly turns green as you make it stronger. It’ll even give you tips on how to improve your password security.
Related article
Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.