The 50 Most Common Leaked Passwords of 2026 - Is Yours on the List?

Every year, security researchers analyze billions of leaked credentials to identify the most commonly used passwords. Every year, the results are depressing. Despite decades of security awareness campaigns, '123456' still reigns supreme.

The Top 10 (Don't Use These)

1. 123456 2. password 3. 123456789 4. qwerty 5. 12345678 6. 111111 7. abc123 8. password1 9. 1234567 10. iloveyou. These ten passwords alone account for over 4% of all leaked credentials. If yours is on this list, change it immediately.

Patterns to Avoid

Beyond the obvious worst offenders, researchers found common patterns: keyboard walks (qwerty, zxcvbn), sports teams, pet names followed by birth years, and the word 'password' with simple substitutions (p@ssw0rd). If a human can think of it as 'clever,' an automated cracking tool already has it in its dictionary.

What the patterns reveal about human habits

Every year the leaked password list looks almost identical to the previous year, which is the most depressing finding in the industry. Variations of 123456, qwerty, password, and the current year continue to dominate the top ten. The persistence is not stupidity. It is friction. When a service forces a user to create yet another account just to access a one time feature, the path of least resistance is to type the same weak password they have used a thousand times before.

Sports teams, pet names, and celebrity references show up in dramatic clusters around their respective fan bases. Lakers, Manchester, and Taylor Swift derivatives spike in regional and demographic ways that attackers actively exploit. Credential stuffing tools include cultural dictionaries tuned to specific geographies and language. A weak password in your local sports lexicon is not safer just because it feels personal. It is just as vulnerable as 123456, only with a slightly larger search space.

Date based passwords remain alarmingly common. Birthdays, anniversaries, and graduation years are trivially found through social media reconnaissance, and they sit in the top 50 most leaked patterns globally. If your password contains a four digit year, an attacker only has to try 100 to 150 combinations to brute force the date component. The cleverness of the prefix or suffix does not save you when the year itself is hardcoded into the common dictionary attacks.

Substitution patterns no longer help. Replacing letters with numbers or symbols, like p4ssw0rd or l3tm31n, has been baked into cracker dictionaries for over a decade. Hashcat ships with rule files that automatically apply hundreds of these substitutions in a fraction of a second per attempt. A password that looks clever is almost certainly already in a precomputed list somewhere. Length and randomness are the only properties that genuinely scale faster than the attackers can iterate.

If you find your password on the list, treat it as compromised on every account where you ever used it, not just the one that leaked. Rotate to a unique passphrase per site, store the new ones in a password manager, and enable multi factor authentication on every account that supports it. The point of these annual lists is not to laugh at the people in them. It is to remind everyone else how thin the line is between their habits and theirs.

The keyboard walk problem

Roughly 1 in 7 passwords in any large breach corpus comes from a keyboard walk. Qwerty, asdf, 1qaz2wsx, zaq12wsx, qazwsx, and their longer cousins like 1qaz!QAZ all rely on the same human shortcut. The fingers move in straight lines or simple diagonals across the keyboard. Attackers know this, and password-cracking tools like Hashcat ship with rule files that generate every plausible keyboard walk pattern in a few seconds. The 2024 RockYou2024 corpus contained roughly 9.9 billion entries, and keyboard walks accounted for over 1.4 billion of them, more than any other single category.

The fix is simple but underused. Almost every password manager, including Apple Passwords, 1Password, Bitwarden, and Dashlane, generates random strings by default that have no keyboard structure at all. A typical 16-character generated password contains a mix of letters, digits, and symbols with no spatial relationship between adjacent characters. Cracking it requires brute-forcing the full keyspace, which at current GPU costs runs into trillions of dollars per password. A keyboard walk, by contrast, falls in milliseconds. The cost of switching is one extension install and ten minutes of habit change, and it eliminates the entire category.

Why birthdays and pet names persist

Cognitive research published in 2018 by Wang, Zhang, Wang, and Yan at IEEE Security and Privacy found that 27 percent of Chinese users and 16 percent of English-speaking users included birthdays in their passwords. Pet names, sports teams, and family members fill out the rest of what the security community calls semantic passwords. The pattern persists in 2026 corpora despite a decade of warnings, because human memory rewards meaning. A random string is forgettable on purpose. A pet name is unforgettable on purpose. The same property that makes one safer makes the other usable, which is the central tension password managers were invented to resolve.

Attackers exploit this with targeted dictionaries built from social media. The 2024 disclosure that LinkedIn's basic profile data had been scraped into a 35 gigabyte file gave attackers easy access to employers, school years, and family member names for hundreds of millions of users. Tools like CUPP and Mentalist mix these data points with common date formats and produce candidate password lists in seconds. The defense is the same defense as everywhere else. Stop trying to memorize unique passwords. Memorize one strong master password and let software remember the rest. Every password manager on the market has been free or near-free for individuals since 2023.

How 1234 became immortal

The string 123456 has topped Have I Been Pwned's most-used password list every single year since the list started in 2017. It is not a coincidence. 123456 is the simplest output of the only universally available input method, the keyboard's number row read left to right. It satisfies the minimum length requirement at most older sites that required exactly six characters, and it is faster to type than any other plausible candidate. The 2009 RockYou breach, which exposed 32 million plaintext passwords from a single MySpace widget vendor, already showed 123456 in first place. Sixteen years later, nothing has changed.

Site operators have leverage to fix this and increasingly use it. NIST SP 800-63B, revised in 2024, recommends rejecting any password that appears in a list of commonly compromised values, with the Have I Been Pwned Pwned Passwords corpus the de-facto reference. Stripe, Notion, and GitHub all reject 123456 at signup. The transition has been slow, but the data shows it works. Sites that block the top 1000 most-leaked passwords see account takeover rates drop by 60 to 80 percent within six months. If you build authentication systems, this is the single highest-leverage change you can make, and it costs almost nothing to implement.

Regional patterns nobody talks about

The top 50 leaked passwords look different in different countries. In Germany, ficken, hallo123, and passwort cluster near the top of localized breach corpora. In Brazil, brasil, corinthians, and a long list of football club names dominate. In Russia, qwerty in Cyrillic transliteration and the strings 123qwe and yandex appear repeatedly. Researchers at SpyCloud, Flashpoint, and Cyentia have all published regional cuts, and the conclusion is consistent. People reach for what is locally familiar. The implication for security teams running a global product is that a single English-only blocklist misses the patterns that actually compromise non-US accounts.

The fix is to compose a blocklist that combines the global Pwned Passwords corpus with regional add-ons. Cloudflare's WAF rules allow custom dictionaries, and Auth0's Custom Password Dictionary supports a per-tenant blocklist of up to 2500 strings. For a company shipping in multiple markets, this is a 30-minute integration that closes a gap most engineering teams do not even know exists. The same logic applies to spelling variants. Football and futbol, password and passwort, qwerty and ywerty in Cyrillic. Defenders who only block the English forms leave the door open for the local ones, and attackers know exactly where to look.

The myth of password complexity rules

For two decades, the standard advice was that strong passwords needed at least one uppercase, one lowercase, one number, and one symbol. Bill Burr, the NIST author who wrote those rules in 2003, publicly disowned them in 2017. The reason is simple. Faced with a complexity rule, humans pick Password1! and reuse it everywhere. The rule produced predictable patterns rather than random ones, which made attacks easier, not harder. NIST SP 800-63B has since removed the requirement entirely. Length and uniqueness matter, character mix does not. That guidance updated in 2024 and is now reflected in OWASP, ISO 27001 controls, and PCI DSS 4.0.

Practical implications for users. Stop trying to satisfy arbitrary complexity rules with clever transformations. Tr0ub4dor3 from the famous XKCD comic falls to cracking faster than its passphrase counterpart correct horse battery staple. If a site still enforces complexity, satisfy it the lazy way and let your password manager do the work. The number of unique characters does not matter when the password is randomly generated and unique to a single site, because the attacker never gets a hash to attack offline. Account lockout policies, rate limiting, and breach checking close all the remaining gaps that complexity rules were originally trying to address.

What replaces passwords in the next five years

Passkeys, built on the FIDO2 WebAuthn standard finalized in 2019, are the most credible replacement and have actual momentum. The FIDO Alliance reported in early 2026 that consumer passkey adoption crossed 15 percent in the US, up from under 4 percent in 2023. Amazon, Apple, eBay, Google, GitHub, Microsoft, PayPal, and Shopify all support passkeys for primary sign-in. The user experience is genuinely better. Face ID or a fingerprint replaces typing a password, and there is nothing to leak in a future breach because the private key never leaves the device. Lock-in to a particular ecosystem remains a concern, but cross-platform syncing has improved substantially.

Hardware security keys, particularly YubiKey 5 and Google Titan, sit alongside passkeys as the high-assurance option for high-value accounts. They are immune to phishing, immune to credential stuffing, and have a per-unit cost of 25 to 75 dollars. For email accounts and identity providers like Google Workspace and Microsoft 365, the cost is trivial relative to the protection. Magic links, SMS codes, and authenticator apps all remain useful but rank below passkeys and hardware keys on every threat model that matters. The shortest path to leaving passwords behind is to enable passkeys today wherever offered, and to keep one hardware key on your keyring as backup.