Bach Seat

Why Are We Still Using Bad Passwords? 123456 is the worst password of 2023. Users have chosen 123456 on more than 23 million breached accounts, even though it takes less than a second to crack. NordPass, the sponsor of the paper, claims that the popularity of 123456 has made it the #1 cracked password for 3 of the last 5 years. In 2019, 12345 from “Spaceballs” overtook it, and “password” did the same in 2022.

Only 2 of 2023’s top 25 passwords will resist an attacker for more than 10 seconds. The 17th most common password, “admin123”, can withstand cracking attempts for a whole 11 seconds. The most secure password in the top 25, “Pass@123”, can fend off an attack for 5 minutes.

NordPass 25 worst passwords 2019 - 2023
	2019	2020	2021	2022	2023
01	12345	123456	123456	password	123456
02	123456	123456789	123456789	123456	admin
03	123456789	picture1	12345	123456789	12345678
04	test1	password	qwerty	guest	123456789
05	password	12345678	password	qwerty	1234
06	12345678	111111	12345678	12345678	12345
07	zinch	123123	111111	111111	password
08	g_czechout	12345	123123	12345	123
09	adst	1234567890	1234567890	col123456	Aa12345
10	qwerty	senha	1234567	123123	1234567890
11	1234567890	1234567	qwerty123	1234567	1234567
12	1234567	qwerty	000000	1234	123123
13	Aa123456.	abc123	1q2w3e	1234567890	111111
14	iloveyou	Million2	aa12345678	000000	Password
15	1234	000000	abc123	555555	12345678910
16	abc123	1234	password1	666666	000000
17	111111	iloveyou	1234	123321	admin123
18	123123	aaron431	qwertyuiop	654321	1111
19	dubsmash	password1	123321	7777777	'P@ssw0rd
20	test1	qqww1122	password123	123	root
21	princess	123	1q2w3e4r5t	D1lakiss	654321
22	qwertyuiop	ompop	iloveyou	777777	qwerty
23	sunshine	123321	654321	110jp110jp	'Pass@123
24	BvtTest123	654321	666666	1111	112233
25	11111	qwertyuiop	987654321	987654321	102030
Nordpass

How can I keep my passwords safe?

Your password should have at least 12 characters

A longer password with more characters is better. It gives a hacker more combinations to try. Some sites may require a certain number of characters in your password, but generally, a password with at least 12 characters is a safe bet.

Use numbers, symbols, uppercase and lowercase letters

The more variety you have, the better. Be sure to include numbers, symbols, capital, and lowercase letters. Make everything as random as possible to keep the hackers out. For example, a password like ‘S#w%i&n(g967’ would be much more difficult to crack than ‘swing967.’

Avoid using any single word as a password. It’s too easy for a hacker to take one lucky guess from a common dictionary, like ‘dog’ or ‘banana.’ Even a password like ‘freeride’, which combines two dictionary words, is too simple.

Don’t use substitutions

Avoid replacing letters with common symbols, it can weaken your password. For example, if you want to use the word ‘lucky’ but instead write it as ‘1ucky.’ It’s too obvious because the 1 and the letter L look too similar.

Choose a passkey over a password

Whenever possible, opt for passkeys instead of passwords. Passkeys, which are unique codes tied to your device, offer more security and are less prone to breaches. Companies such as Amazon, Apple, Google, and Microsoft are increasingly supporting passkeys as a safer alternative.

rb-

We should approach NordPass’ findings with caution due to their unclear methodology. They are not very transparent about their methodology. The presser said the passwords were “compiled in partnership with independent researchers specializing in researching cybersecurity incidents. They evaluated a 4.3TB database extracted from various publicly available sources…”

There are some suspicious trends in the Nordpass’s data. English words make up all of the top 25 recognizable passwords. Quite a feat for over 24 billion credentials breached since 2016. Many other are numerical strings or the result of typing nearby keys on a QWERTY keyboard. Despite these issues, the report makes for interesting geek reading.

Related article

• 90+ Key Password Breach Statistics in 2023 (TechReport)

Ralph Bach has been in IT for a while and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow me on Facebook. Email the Bach Seat here.