The Most Common Passwords of 2025 (and Why They Fail)

The 2025 top 20

Each year NordPass (with NordStellar) analyses recent public breaches and dark-web repositories to rank the most-used passwords. Here is the global top 20 for 2025 — and the striking thing is how little it changes year to year:

#	Password	#	Password
1	123456	11	1234567
2	admin	12	123123
3	12345678	13	111111
4	123456789	14	12345678910
5	12345	15	P@ssw0rd
6	password	16	Password
7	Aa123456	17	Aa@123456
8	1234567890	18	admintelecom
9	Pass@123	19	Admin@123
10	admin123	20	112233

Why these fall instantly — it's not about length

It's tempting to say these are weak because they're short. The deeper reason is that they're on every attacker's list. Real password attacks don't start with brute force; they start by trying the most common passwords first, then dictionaries and known-breached lists. A password on the top-200 list is cracked in the first fraction of a second — its "strength" on paper is irrelevant. This is why our password crack-time table (which models random passwords) doesn't apply to any password on this list: they never make an attacker brute-force anything.

Complexity theatre: P@ssw0rd and friends

A genuinely interesting shift in 2025: far more entries include special characters — 32 of the top 200, up from just 6 the year before. That sounds like progress, until you look at which ones: P@ssw0rd, Pass@123, Aa@123456, Welcome@123. These are predictable substitutions — exactly the patterns crackers try first. Swapping a→@ and o→0 on a dictionary word adds almost no real strength, because the attacker's rules already expand those substitutions automatically. It's complexity that satisfies a password policy without defeating anyone. Length and randomness beat this "theatre" every time — see how to create a strong password.

The default-credential problem

admin at #2, plus admin123, admintelecom and Admin@123, point at a different failure: unchanged default credentials on routers, IoT devices, telecom equipment and admin panels. Many of these are never changed from the factory setting, and automated attacks scan the internet for exactly them. If you manage any device or service, changing default admin passwords is one of the highest-impact things you can do.

No generation is safe

Researchers expected to find meaningful differences between age groups and instead found "striking uniformity in vulnerabilities." 123456 and 12345 topped the list in every generation. Despite a decade of awareness campaigns, widespread password hygiene has barely moved. The lesson isn't "try harder to memorise better passwords" — it's that humans are bad at this, and the fix is tooling.

How to not be on this list

• Never choose a password yourself. Generate a random one with our password generator — it will never resemble anything on a common-password list.
• Use a password manager so every account gets a unique random password you don't have to remember.
• Turn on two-factor authentication — it protects you even if a password is guessed or leaked.
• Change default credentials on every device and admin account immediately.
• Check your instincts with the strength checker — but remember it can't tell you a password is on a breach list, only estimate its randomness.