Sunday, September 13, 2026

List of Top 25 Worst Passwords of 2026 Based On 5 Million Leaked Passwords

Passwords are the strings of cards used to verify the identity of the user, when the passwords are extracted they are free simple and viable approach to gain access to unapproved individuals accounts.

After evalvating millions of passwords SplashData determines the common passwords used by Internet users during that year. The most terrible password used are “123456” and “password”.

They continue to hold the #1 and #2 spots, respectively, the easily hackable password will put a substantial risk of getting beig hacked.

Also a new password debuted this year list “donald” ranked 23rd position, “Sorry, Mr. President, but this is not fake news – using your name or any common name as a password is a dangerous decision,” said Morgan Slain, CEO of SplashData, Inc.“

Every year SplashData evaluate millions of old password from data breaches to determine the weakest passwords.

According to the SplashData almost 10% of the people used one of the most 25 worst passwords on the year’s list and only 3% of people have used the worstpassword, “123456”.

Here is the list of top 25 passwords used in year 2026

  • 123456 (Rank unchanged from last year)
  • password (Unchanged)
  • 123456789 (Up 3)
  • 12345678 (Down 1)
  • 12345 (Unchanged)
  • 111111 (New)
  • 1234567 (Up 1)
  • sunshine (New)
  • qwerty (Down 5)
  • iloveyou (Unchanged)
  • princess (New)
  • admin (Down 1)
  • welcome (Down 1)
  • 666666 (New)
  • abc123 (Unchanged)
  • football (Down 7)
  • 123123 (Unchanged)
  • monkey (Down 5)
  • 654321 (New)
  • !@#$%^&* (New)
  • charlie (New)
  • aa123456 (New)
  • donald (New)
  • password1 (New)
  • qwerty123 (New

“Our hope by publishing this list each year is to convince people to take steps to protect themselves online,” said Morgan Slain, CEO of SplashData, Inc.

Tips to Stay Safe

  • Use a complex password, enforce strong password policy.
  • Check the password regularly, Use two-factor authentication(2FA) for vital sites like managing an account and Emails, make sure all the passwords are unique.
  • Change the Manufactures default Password that gadgets are issued with before they are conveyed to the IT Department.
  • Configure using password Manager only for your less important websites and accounts.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Dixons Carphone Suffers Massive Data Breach, 5.9 Million Payment Cards & 1.2 Million Personal Data Exposed

37,000 Eir Customer’s Personal Data Exposed as their Company Laptop Stolen

Dell Hacked – Data Breach Exposed Names, Email addresses & Hashed Passwords

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Hot this week

How To Access Dark Web Anonymously and know its Secretive and Mysterious Activities

What is Deep Web The deep web, invisible web, or...

How to Build and Run a Security Operations Center (SOC Guide) – 2023

Today’s Cyber security operations center (CSOC) should have everything...

Russian Hackers Bypass EDR to Deliver a Weaponized TeamViewer Component

TeamViewer's popularity and remote access capabilities make it an...

Web Server Penetration Testing Checklist – 2026

Web server pentesting is performed under three significant categories: identity,...

ATM Penetration Testing – Advanced Testing Methods to Find The Vulnerabilities

ATM Penetration testing, Hackers have found different approaches to...

Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data

Threat actors are increasingly using Claude-based AI workflows to...

China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks

China-linked threat actors UTA0560 and JungleBamboo chained a Google...

New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets

A newly identified phishing campaign is abusing the legitimate...

CISA Warns of Critical GitLab Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has...

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

A long-running pay-per-install (PPI) operation that used YouTube gaming...

VLC Media Player Flaws Let Attackers Corrupt Memory and Leak Sensitive Data

Two security vulnerabilities in VLC media player versions 3.0.0...

CISA Adds Exploited MikroTik RouterOS Flaws to Security Alert

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has...

Related Articles

Recent News