Most Common Passwords: From the Gawker Leak to 2026

What are the most common passwords people use? In December 2010 hackers broke into Gawker Media, owner of Lifehacker, Gizmodo and Kotaku, and published about 188,000 cracked passwords. The most popular one was 123456. Fifteen years later, it’s still at the top of the list. Here’s what the Gawker breach showed, the latest data, and how to choose passwords that won’t end up on such a list.

Quick answer: The most common password is still 123456, according to NordPass’s 2025 list, just as it was in the 2010 Gawker leak. Other common choices are simple number strings, “password”, “admin” and keyboard patterns like “qwerty”. Use a password manager to create a unique, long password for every account and turn on two-factor authentication or passkeys.

Gawker Media’s most common passwords (2010)

The Wall Street Journal analysed the leaked data and listed the top 50 Gawker passwords. Even readers of tech blogs picked the easiest options:

• 123456 was the most common by far.
• password came second.
• Number patterns like 12345678, 111111 and 12345 followed.

People chose them because they were easy to remember. The real danger: many used the same email and password on other sites, so one leak exposed their email and other accounts too.

Most common passwords in 2026

NordPass’s 2025 study (external site), based on breach data from September 2024 to September 2025, found that 123456 is still the world’s most common password, and that 12345 and 123456 top the list in every age group. Attackers try these lists first, so such passwords fall in seconds.

How to choose strong passwords

• Use a password manager such as Bitwarden, 1Password or the one built into your browser or phone to generate and remember passwords.
• Make it long: at least 14-16 characters, or a passphrase of four or more random words.
• Never reuse passwords; reuse is how one breach spreads to your other accounts.
• Turn on two-factor authentication, ideally with an authenticator app or security key.
• Use passkeys where available; Google, Apple, Microsoft and many sites now support them.

Check if your password was leaked

Use Pwned Passwords (external site) to see whether a password has appeared in known breaches, and check your email on Have I Been Pwned. Many password managers and browsers also warn you about leaked passwords automatically. If one of yours shows up, change it everywhere you used it.

Running a WordPress site? See how to protect posts with a password and give readers a way to log out.

FAQ

What is the most common password in the world?

123456, which has topped password lists for more than a decade.

How long should a password be?

Aim for at least 14-16 characters, or use a passphrase or passkey.

Are password managers safe?

Reputable password managers encrypt your vault and are far safer than reusing simple passwords. Protect yours with a strong master password and two-factor authentication.