The Key Numbers at a Glance
Every figure on this page names its source and the date it was read. Where a number is our own count or our own model, we say so.
| Number | What it measures | Source |
|---|---|---|
| 21,627,656 | Count shown for 123456, the most common password in the NordPass 2025 list. It topped 6 of the 7 editions. | NordPass, 7th edition |
| 57 of 200 | Passwords in the NordPass top 200 that are digits only. | Our count of the NordPass table |
| 121 of 200 | Passwords in the NordPass top 200 that are 8 characters or fewer. | Our count of the NordPass table |
| 17,846,550,965 | Breached addresses counted by Have I Been Pwned, across 1,047 breached websites (home-page counters, read 22 October 2026). | Have I Been Pwned |
| 22% | Share of breaches where credential abuse was the initial access vector in the 2025 report, level with vulnerability exploitation at 20%. | Verizon DBIR 2025 |
| 30% | Share of breaches involving a third party in the 2025 report, reported as double the previous year. | Verizon DBIR 2025 |
| 99.22% | Reduction in the risk of account compromise associated with multifactor authentication in a Microsoft Research study (98.56% when credentials had leaked). | Microsoft Research, 2023 |
| 15 and 8 | Minimum password length NIST sets: 15 characters when the password is the only factor, 8 when it is used with MFA. | NIST SP 800-63B-4 |
Most Common Passwords: NordPass 2025
NordPass's seventh annual list covers data from September 2024 to September 2025 across 44 countries. 123456 has been number one in six of the seven editions. The table shows the top 10 with the counts NordPass lists. The counts are as published, and NordPass does not describe in the table exactly how each count is measured, so use them to compare passwords against each other rather than as a headcount of people.
| Rank | Password | Count |
|---|---|---|
| 1 | 123456 | 21,627,656 |
| 2 | admin | 21,030,012 |
| 3 | 12345678 | 8,274,408 |
| 4 | 123456789 | 5,673,712 |
| 5 | 12345 | 3,950,777 |
| 6 | password | 3,545,119 |
| 7 | Aa123456 | 2,520,728 |
| 8 | 1234567890 | 1,418,939 |
| 9 | Pass@123 | 1,210,039 |
| 10 | admin123 | 1,087,247 |
The full top 200, the other published lists and the patterns behind them are on our Most Common Passwords page.
What the Top 200 Looks Like
We counted the entries in NordPass's table of 200 passwords on 15 October 2026. These are our own counts, not NordPass figures.
| Measure | Result |
|---|---|
| Share of all listed counts held by the top 10 | 65.8% |
| Share of all listed counts held by the top 20 | 73.4% |
| Digits only | 57 of 200 |
| Lowercase letters only | 25 of 200 |
| Contain a symbol | 33 of 200 |
| Contain a keyboard pattern (qwerty, asdf, 1q2w3e, azerty) | 31 of 200 |
| Contain the word admin | 18 of 200 |
| 6 characters or fewer | 42 of 200 |
| 8 characters or fewer | 121 of 200 |
| 12 characters or more | 6 of 200 (longest: 18) |
| Median length | 8 characters |
Under our crack-time model (see below), 86 of these 200 passwords would fall to pure brute force in under a second, 116 in under a minute and 169 in under a day, and only 12 would take more than a year. In practice attackers do not need brute force for these: they try published lists like this one first, so every entry is guessed almost immediately.
Breach Statistics
- Breached addresses: Have I Been Pwned's home page showed 1,047 breached websites and 17,846,550,965 breached addresses when we read it on 22 October 2026. A person can appear in more than one breach, so this is not a count of people.
- How credentials get abused: in Verizon's 2025 report, which analyzed more than 22,000 security incidents including 12,195 confirmed data breaches, credential abuse was a leading initial access vector at 22%, level with vulnerability exploitation at 20%.
- Third parties: the same report says third-party involvement in breaches doubled to 30%. A breach at a company you never chose directly can still expose your login.
If a breach reaches you, our Data Breach Checklist lists what to do in order.
Authentication Statistics
- MFA and compromise risk: a May 2023 Microsoft Research study reported that multifactor authentication reduced the risk of compromise by 99.22% across the population studied, and by 98.56% in cases of leaked credentials. It is one study of one company's accounts, so treat the numbers as strong evidence and not as a guarantee for every account.
- What CISA says: any MFA is better than none, and phishing-resistant MFA based on FIDO/WebAuthn is the strongest option. Passkeys are built on that standard.
- NIST length rules: SP 800-63B-4 (August 2025) sets a minimum of 15 characters when a password is the only factor and 8 when it is paired with MFA. It also says services should allow at least 64 characters and should not force composition rules or periodic changes.
Crack-Time Reference (Our Model)
These times come from our own calculator, not from a measured attack. We assume random characters from the 94 printable ASCII characters and an attacker who has a stolen database and tries 150 billion guesses per second against a fast hash. Services that store passwords with slow hashing make real attacks much slower, but you cannot tell which method a site uses, so we plan for the worse case.
| Length | Entropy | Average time |
|---|---|---|
| 8 characters | 52 bits | 6 hours |
| 10 characters | 66 bits | 6 years |
| 12 characters | 79 bits | 50 thousand years |
| 14 characters | 92 bits | 444 million years |
| 16 characters | 105 bits | 4 trillion years |
The method and a longer table are in How Long Does It Take to Crack a Password? You can test your own with the Password Strength Checker.
Methodology and How to Cite This Page
- Read dates: NordPass table on 15 October 2026, Have I Been Pwned counters on 22 October 2026, Verizon and Microsoft figures from the sources listed below.
- Our own counts: the top 200 analysis counts entries in NordPass's published table. We did not have access to any raw data.
- Our own model: crack times are estimates from a stated formula, not experiments.
- Updates: we revisit this page each year when NordPass publishes a new edition, and when a source changes a figure we correct it.
- Citing: you are welcome to quote any figure with a link to this page. For headline figures, please also cite the original source named in the table.
Sources
- NordPass: Most Common Passwords, seventh edition (data from September 2024 to September 2025). Top 10 and counts read from the NordPass page; top 200 counted by us on 15 October 2026.
- Have I Been Pwned, home page counters read on 22 October 2026.
- Verizon 2025 Data Breach Investigations Report press release (as republished by Officer.com). Figures: more than 22,000 incidents, 12,195 confirmed breaches, credential abuse 22%, vulnerability exploitation 20%, third-party involvement 30%.
- Microsoft Research: How effective is multifactor authentication at deterring cyberattacks? (May 2023; arXiv:2305.00945).
- NIST SP 800-63B-4, August 2025.
- CISA: Multifactor Authentication.