INDIANA — Cybersecurity experts are urging businesses and individuals to audit their login credentials after a new study revealed the most common words, names, and numerical sequences found in breached password databases.
Insurance experts at Alan Boswell Group analyzed password data from Have I Been Pwned, a database containing hundreds of millions of credentials compromised in real-world data breaches, to identify the most frequently used password choices.
Simple Sequences and Default Credentials Top the List
Despite years of warnings from cybersecurity professionals, sequential numbers and default words remain overwhelmingly popular among internet users.
The numerical sequence “123456” emerged as the most common password in the analysis, appearing nearly 210 million times (209,972,844). It was followed by “123456789” (80.9 million uses) and “12345678” (70.3 million uses).
Crucially for workplace security, the default credential “admin” appeared more than 42 million times, raising significant concerns for organizations that fail to enforce credential updates or block default administrative logins.
| Rank | Password | Occurrences in Breached Data |
| 1 | 123456 | 209,972,844 |
| 2 | 123456789 | 80,942,123 |
| 3 | 12345678 | 70,382,347 |
| 4 | password | 52,256,179 |
| 5 | admin | 42,085,691 |
Common Names, Pop Culture, and Preferences
The study also highlighted widespread reliance on predictable proper nouns, personal names, and pop culture references across online accounts:
- Names: “Daniel” ranked as the most common personal name used as an exact password (2.53 million times), followed by “Michael” (2.33 million) and “Jessica” (1.89 million).
- Sports & Teams: “Football” led all sports terms with over 2.6 million uses. Premier League club Liverpool was the top-ranked sports team, appearing nearly 1.8 million times, while the Pittsburgh Steelers (503,219) topped NFL teams.
- Fictional Characters & Pop Culture: “Superman” was the top fictional character (2.13 million uses), followed by “Naruto” (1.64 million) and “Batman” (1.33 million). Among musical acts, “Blink-182” appeared 1.65 million times, followed by “Metallica” (1.12 million).
- Animals & Objects: “Monkey” appeared nearly 4 million times (3,963,423), making it one of the single most frequent non-numerical passwords overall, while “computer” led everyday objects at 2.42 million uses.
- Years: “2020” emerged as the most popular year (1.44 million uses), which researchers attribute to users adding recent years to simple words to meet basic complexity rules.
Risks and Recommendations for Businesses
Security professionals warn that using predictable terms exposes both personal and corporate networks to “credential stuffing” and brute-force attacks, where automated software systematically tests thousands of known passwords in seconds.
To mitigate these risks, organizations are advised to:
- Implement Blocklists: Configure identity management systems to disallow common terms, default words, and known compromised passwords.
- Require Multi-Factor Authentication (MFA): Enforce multi-factor authentication across all corporate tools and administrative portals.
- Adopt Password Managers: Encourage employees to utilize enterprise password managers to generate and store long, unique passphrases.
