Top Common Passwords in 2024 Revealed 

It’s no secret that cybercrime is on the rise, and passwords that don’t stay secret are partly to blame; 81% of hacking-related breaches involve weak or stolen passwords. And, spoiler alert, “secret” is the #1 common password for personal use.  

A November report from NordPass analyzed 2.5 terabytes of publicly available data, including data from the dark web, revealing the most common passwords used in the U.S. at home and work in 2024. 

Read on to see if any of your passwords are on either of the lists, why they’re so easy to crack, and how to secure your passwords. 

20 Most Common Personal Passwords 

Each of these took less than one second to crack. 

1. secret 
2. 123456 
3. password 
4. qwerty123 
5. qwerty1 
6. 123456789 
7. password1 
8. 12345678 
9. 12345 
10. abc123 
11. qwerty 
12. iloveyou 
13. Password 
14. baseball 
15. 1234567 
16. 111111 
17. princess 
18. football 
19. monkey 
20. sunshine 

20 Most Popular Corporate Passwords 

These are similar to the ones people use in their personal lives, and all but number 13 took less than a second to crack. 

1. password 
2. 123456 
3. qwerty123 
4. qwerty1 
5. aaron431 
6. password1 
7. welcome 
8. 12345678 
9. Password1 
10. abc123 
11. qwerty 
12. 123456789 
13. jonathon (took 3 hours to crack) 
14. newpass 
15. Password 
16. sunshine 
17. 111111 
18. baseball 
19. maggie 
20. soccer

How Hackers Hack Passwords 

Hackers use advanced software to test billions of combinations in seconds. Here are some of their methods: 

1. Brute Force Attack: The system tests every possible combination until the correct one is found. Simple passwords are cracked in under a second. 
2. Dictionary Attack: Hackers use lists of common passwords, often based on compromised databases. Words like “password” or sequences like “123456” are tested first. 
3. Password Spraying: This technique targets large numbers of accounts. Hackers try a single shared password against many user accounts to see if it works. 
4. Credential Stuffing: When hackers gain access to one account, they use the same credentials to try to access linked services. 
5. Phishing: Hackers trick email recipients into revealing their passwords by clicking malicious links or providing sensitive information on fake login pages. 

Best Practices for Protecting Your Accounts 

Hopefully, these steps to protect your passwords and data are second nature to you, but here is a quick reminder. 

1. Use strong and long passwords. Use a mix of upper- and lowercase letters, numbers, and special characters, avoiding common words or personal information. Ideally, passwords should be 12-16 characters. 
2. Don’t reuse the same password for multiple accounts. This limits the damage if one account is compromised. 
3. Use a password manager. These tools help generate and store secure passwords, eliminating the need to remember them all. 
4. Enable multi-factor authentication (MFA). Even if hackers obtain your password, a secondary code sent to your phone or email will block them. 
5. Update passwords periodically. Changing sensitive passwords at least every six months is a good habit.

Despite the best precautions, a single mistake can open the door to serious cybersecurity issues. That’s why providing managed phishing and cybersecurity awareness training services for employees is a must. 

“In today’s digital landscape, end users need the skills and awareness to avoid falling victim to cyberattacks,” explains Jo Bradley, PrivaPlan’s Cybersecurity Literacy and Phishing Coordinator. “Simulated phishing and training provide real-world experience, empowering employees to recognize and avoid threats. The focus is on education, not entrapment, helping users build confidence and resilience.”