Why \"123456\" Is Still the Most Common Password in 2026

It has led the global list six of the last seven years. The reason has nothing to do with being careless, and once you see the real one, the fix is easy.

What's in this article:

The short version

"123456" has been the world's most common password six out of the last seven years, and password quality is equally poor across every age group, including Gen Z. The cause is memory, not carelessness. The fix is to stop asking your memory to do a job it was never going to do well. That can mean a password manager, or something as simple as a well-kept password book. What matters is that every account gets its own strong password.

The list that never changes

Every year, researchers publish a list of the most common passwords found in data breaches. Every year, people read it, wince, and nothing much changes.

The most recent study analyzed public breaches and dark web repositories from September 2024 through September 2025, across 44 countries. "123456" came out on top again, making six out of seven years it has held the number one spot globally.

Here is the part that surprised even the researchers. They expected a generational gap, with younger users choosing better passwords than older ones. They did not find one.

Password quality was equally poor across every age group, from the Silent Generation through Gen Z, and "12345" and "123456" were the top choice in every single bracket. The main difference was flavor.

Older users leaned on names like "maria," while Gen Z slipped in trending words like "skibidi." Both are just as easy to crack.

6 of 7years "123456" has topped the global list

Everyage group picked "12345" of "123456" first

94%of leaked passwords studied were reused, not uniques

Sources: NordPass and NordStellar, Top 200 Most Common Passwords, September 2024 to September 2025 across 44 countries; Cybernews analysis of 19 billion leaked passwords, April 2024 to April 2025

It is not a laziness problem

The usual response to that list is to shake your head at how careless people are. That reaction is understandable and almost entirely wrong.

When researchers asked people why they reuse passwords, the answers were not about laziness. In a NordPass survey, about 62 percent of Americans admitted they often or always reuse a password. Half said the reason was simply that it is easier to remember fewer passwords. And 40 percent said they were afraid of locking themselves out of their own accounts if every password were different.

That last one is the key. The biggest driver is fear of being locked out, and that is a reasonable worry, not carelessness. It is what happens when a system asks you to memorize dozens of unique strings and then locks the door when you forget one.

Warning!

A weak password puts one account at risk. A reused password puts every account that shares it at risk. When one company gets breached, attackers try those email and password pairs everywhere else. That is why the same password on your email and your bank is the single worst habit on this list.

What actually happens when a password leaks

It helps to know what you are actually defending against, because the picture most people have in their head is wrong.

Almost nobody is sitting at a keyboard guessing your password. Instead, a company you have an account with gets breached, and millions of email and password pairs end up for sale or posted publicly. Attackers load that list into software and automatically try every pair against hundreds of other sites: banks, email providers, shopping accounts, social media.

This is called credential stuffing, and it costs the attacker almost nothing. They are not targeting you. They are running a list, and your details are on it.

The scale of the reuse problem is what makes this work so well. One study analyzed more than 19 billion passwords exposed in breaches between April 2024 and April 2025 and found that only about 6 percent were unique. Roughly 94 percent had been reused or duplicated somewhere.

So the real question is not whether your password is clever. It is whether the password that leaks from some forum you joined in 2019 also opens your email today. If it does, little else about your security matters.

Why "Password123" does not help either

Most people know "123456" is bad, so they do something that feels smarter. They take a word and add a capital letter at the front and a number or symbol at the end. "Password123." "Summer2026!" "Fluffy1!"

The catch is that everyone reaches for the same trick. In the most recent list, the number of top passwords using special characters jumped from six to thirty-two in a single year, but they were things like "P@ssw0rd" and "Admin@123." Password cracking tools are built around exactly these patterns, because they are the patterns people reliably produce. Capital first letter, number at the end, an exclamation point or an @ swapped for an a. A tool that expects that structure gets through it almost as fast as it gets through "123456."

Complexity rules gave us the feeling of security without much of the substance. If you have been doing this, you were following the advice you were given. The advice just has not kept up.

The Fix: stop trying to remember

If the core problem is memory, then the solution is not a better memory trick. It is keeping your passwords somewhere other than your head, so each account can have its own strong one without you having to recall it.

You have two good ways to do that, and neither is wrong.

A password manager is an app that creates a long random password for every account and stores them behind one master password. You remember one thing and it handles the rest, including filling passwords in when you log in. Your browser likely has one built in that stores passwords in an encrypted file on your own device. Standalone apps also exist that sync across your devices through the cloud, though that means trusting one more company to hold your data, and password manager companies have been breached before. We do not push a specific product.

A password book is exactly what it sounds like: a small notebook where you write each account and its password by hand. This gets dismissed as old-fashioned, but for a lot of people it is genuinely a good answer. It is offline, so no company breach and no malware can ever reach it, and it is simple, which matters if apps feel like a chore. The only real risk is someone physically finding it, so you keep it somewhere private at home. A password book you actually use beats a manager you never set up.

Whichever you choose, it answers the fear that drives reuse. You cannot lock yourself out of an account for forgetting a password you were never trying to remember.

One caution applies to the app-based options but not the book. A password manager protects you from a company being breached, but not from malware on your own computer, which is sometimes built to steal saved passwords off your device. A paper book in a drawer has none of that exposure, which is part of why it remains a reasonable choice.

Tip

Do not try to fix everything at once, You do not need to move a hundred accounts in one sitting. Start with your email, since it is the account that can reset all the others. Then your bank. Everything else can wait until the next time you happen to log in.

Building a master password you will not forget

Whichever method you chose, one password still lives in your head. For a manager it is the master password. For a password book it is your email password, since that account can reset the others. Either way, make that one genuinely strong, so it is worth a few minutes of real thought.

The most reliable approach is a passphrase. Pick four or five random, unrelated words and string them together. Something like "lantern-oatmeal-drift-copper-nine."

That looks almost too simple to be secure, but it works. Length is the biggest factor in how hard a password is to crack, and a five-word phrase easily runs past thirty characters. It is also easy to remember, because you can picture it. An eight-character scramble like "Xk7#mQ2z" feels stronger but is actually weaker, and you will never recall it.

Two rules for choosing the words. Do not use a phrase from a song, movie, or book, because those exist in cracking dictionaries. And do not use words connected to your own life, like your kids' names or your street, because those are on your social media.

Try it before you commit to it

Our free Password Strength Checker and Generator shows you how long a password would take to crack, and can build a strong passphrase for you. It runs entirely in your browser, so nothing you type is ever sent to us or stored anywhere.

Find out if yours has already leaked

Before you start changing things, it is worth knowing where you actually stand. There is a good chance at least one of your passwords is already sitting in a breach database somewhere, and that is not a reflection on you. It usually means a company you trusted got breached.

Many password managers, including the ones built into web browsers, include a built-in check that flags any of your saved passwords that have shown up in a known breach. Turn it on once you are set up and let it work in the background. There is also a free, trusted website called Have I Been Pwned where you can enter your email address and see whether it has appeared in known breaches, without typing in any passwords.

If you find that a password has leaked, do not panic and do not try to fix everything at once. Change it on the account it belongs to first. Then change it anywhere else you used the same password, which is the part that actually matters. A leaked password only becomes a real problem when it opens more than one door.

What to do this week

Change your email password first.. Whoever controls your email can reset the password on everything else you own. It is the master key.
Choose your method. A password manager, or a password book kept somewhere private. Either works. Our step-by-step setup guide covers the manager route if you want a hand.
Make one strong master password. Four or five random unrelated words strung together. Test it in our free Password Strength Checker before you commit. This is the one you keep in your head.
Turn on two-step login for email and banking. Even if a password leaks, this stops someone from getting in with it alone.
Replace the rest gradually. Each time you log into something, give it a new unique password and save it. In a month you are mostly done without ever sitting down to do it all at once.

Test yourself

Which of these is the strongest password?

A. Password123! B. Xk7#mQ2z C. Lantern-copper-drift-meadow-nine D. MyDogFluffy2026

See the answer

The answer is C: the string of random words. Length matters more than symbols. "Xk7#mQ2z" looks tough but it is only eight characters. The word string is over thirty characters, uses words with no connection to each other or to you, and you can actually remember it. The other two follow patterns that cracking tools are built to expect.

Common questions

Is it safe to keep all my passwords in one app?

It is safer than the alternative most people are living with, which is a handful of reused passwords across dozens of accounts. Reputable password managers encrypt your data so that even the company itself cannot read it. The realistic risk of reuse is far higher than the theoretical risk of a manager being breached.

What happens if I forget my master password?

Most password managers cannot recover it for you, which is a security feature rather than a flaw. Write it down on paper and keep it somewhere physically safe at home. A piece of paper in a drawer is not the vulnerability people imagine, since a burglar is not who is trying to get into your accounts.

Do I need to change all my passwords right now?

No. Change your email password today, then your bank. After that, let the manager replace passwords naturally as you log into things. Trying to do all of them in one session is how people give up halfway.

Are passkeys going to make this unnecessary?

Eventually, possibly. Passkeys let you sign in with your fingerprint or face instead of a password, and support is growing. But most accounts still require passwords, so this is a transition rather than a switch. Strong unique passwords matter for as long as passwords exist.

Is it safe to type a password into an online strength checker?

It depends entirely on the checker. Ours runs in your browser, meaning what you type never leaves your device and is never sent to us or stored. Many others do send your input to a server. As a general rule, never type a password you actually use into any tool that does not clearly say it works locally. Test a variation instead.

Is a password written on paper better than reusing one?

Yes, meaningfully. A notebook in your home is not reachable by someone running an automated attack from another country. It is not as good as a password manager, but it beats reuse by a wide margin.

Written by: Simple Digital Safety, founded by an IT and cybersecurity professional with 20+ years of experience, including protecting Fortune 500 companies.
Published: August 2026
Our standard: Every statistic is traced to a named primary source. If we cannot verify a number, we leave it out rather than repeat it.
Disclosure: No affiliate links or sponsored product placements in this article.

Sources cited

NordPass and NordStellar, Top 200 Most Common Passwords, seventh edition. Public breach and dark web data from September 2024 to September 2025, across 44 countries
NordPass password reuse survey of US adults, 2025
Cybernews analysis of 19 billion passwords exposed in breaches between April 2024 and April 2025