'123456' Surpasses 'Password' as Most Common Password
By Jennifer LeClaire / Data Storage Today. Updated January 20, 2014.
In an age of data breaches and identity theft, you would think consumers would take password security a little more seriously. But passwords like "123456" and "iloveyou" are still among the list of most common passwords found on the Internet.
SplashData just announced its annual list of the 25 most common online passwords. For the first time since SplashData began compiling its annual list, "password" has lost its title as the most common and therefore worst password. The two-time runner-up "123456" took the dubious honor while "password" fell to second place.
"Seeing passwords like 'adobe123' and 'photoshop' on this list offers a good reminder not to base your password on the name of the Web site or application you are accessing," said Morgan Slain, CEO of SplashData.
According to SplashData, this year's list was influenced by the large number of passwords from Adobe users posted online by security consulting firm Stricture Consulting Group following Adobe's well-publicized security breach.
SplashData's list of frequently used passwords reveals that many people continue to put themselves at risk by using weak, easily guessable passwords. Some other passwords in the Top Ten include "qwerty," "abc123," "111111," and "iloveyou."
"Another interesting aspect of this year's list is that more short numerical passwords showed up even though Web sites are starting to enforce stronger password policies," Slain said. For example, new to this year's list are simple and easily guessable passwords like "1234" at No. 16 on the list, "12345" at No. 20, and "000000" at No. 25.
SplashData's top 25 list was compiled from files containing millions of stolen passwords posted online during the previous year. The company advises consumers or businesses using any of the passwords on the list to change them immediately. Others on the list include admin, letmein, monkey, shadow, abc123, princess, password1, sunshine and 1234567890.
"As always, we hope that with more publicity about how risky it is to use weak passwords, more people will start taking simple steps to protect themselves by using stronger passwords and using different passwords for different Web sites," Slain said.
Creating Solid Passwords
SplashData suggests using passwords of eight characters or more with mixed types of characters. But even passwords with common substitutions like "dr4mat1c" can be vulnerable to attackers' increasingly sophisticated technology, and random combinations like "j%7K&yPx$" can be difficult to remember.
The company said one way to create more secure passwords that are easy to recall is to use passphrases -- short words with spaces or other characters separating them. It's best to use random words rather than common phrases. For example, "cakes years birthday" or "smiles_light_skip?"
Avoid using the same username-password combination for multiple Web sites, the firm suggests, and especially risky is using the same password for entertainment sites that you do for online email, social networking, or financial service sites. Finally, use different passwords each time you sign up for a new Web site or service.