Businesses are being urged to take a closer look at the passwords staff are using, after new analysis revealed the words, names and number combinations appearing most often in leaked password data. But this is not just a workplace issue; anyone using similar passwords for personal email, banking, shopping or social media accounts could also be putting themselves at risk.
Insurance experts at Alan Boswell Group analysed password data from Have I Been Pwned, which contains hundreds of millions of passwords exposed in data breaches, to identify the most common password choices used online.
From names, years and number combinations to sports, football teams, famous figures, fictional characters, animals, plants and everyday objects, these are the passwords people should avoid using.
The most-used passwords overall
Despite repeated warnings against using simple number combinations, ‘123456’ remains the most common password in the analysis, appearing 209,972,844 times.
‘123456789’ is the second most common, appearing 80,942,123 times, followed by ‘12345678’, which appears 70,382,347 times.
Rank | Password | Number of times used |
1 | 123456 | 209,972,844 |
2 | 123456789 | 80,942,123 |
3 | 12345678 | 70,382,347 |
4 | password | 52,256,179 |
5 | admin | 42,085,691 |
6 | 12345 | 31,033,620 |
7 | qwerty | 30,799,395 |
8 | 1234 | 30,272,674 |
9 | 1234567 | 19,842,479 |
10 | 1234567890 | 19,783,628 |
The most-used names in passwords
The name ‘Daniel’ is the most commonly used name in passwords, appearing as an exact password 2,533,375 times.
‘Michael’ follows in second, appearing 2,332,388 times, while ‘Jessica’ ranks third, appearing 1,893,068 times.
Other names including Thomas, Ashley, Anthony, Michelle and Nicole also appear among the most common password choices.
Rank | Password | Number of times used |
1 | Daniel | 2,533,375 |
2 | Michael | 2,332,388 |
3 | Jessica | 1,893,068 |
4 | Thomas | 1,841,082 |
5 | Michelle | 1,739,541 |
6 | Ashley | 1,727,577 |
7 | Jennifer | 1,551,347 |
8 | Nicole | 1,542,022 |
9 | Alexander | 1,511,905 |
10 | Anthony | 1,419,164 |
The most-used years in passwords
When it comes to years, 2020 is the most commonly used, appearing as an exact password 1,441,965 times.
The year 1990 is second, appearing 712,954 times, while 2021 follows in third, appearing 659,470 times.
Years like 1990, 1994 and 1989 may point to people using birth years or important dates, while more recent years such as 2020, 2021Â and 2022 could reflect passwords created for newer accounts, where users simply added the current year to make a password meet security requirements.
Rank | Password | Number of times used |
1 | 2020 | 1,441,965 |
2 | 1990 | 712,954 |
3 | 2021 | 659,470 |
4 | 2000 | 541,734 |
5 | 2002 | 531,133 |
6 | 2004 | 529,772 |
7 | 2022 | 504,185 |
8 | 1994 | 504,092 |
9 | 1989 | 500,207 |
10 | 2001 | 494,366 |
The most-used football teams in passwords
The top five football teams used in passwords are Liverpool, Barcelona, Juventus, Chelsea and Arsenal.
Liverpool is the most commonly used team, appearing as an exact password 1,789,470 times, followed by Barcelona, which appears 1,285,484 times.
Rank | Password | Number of times used |
1 | Liverpool | 1,789,470 |
2 | Barcelona | 1,285,484 |
3 | Juventus | 1,230,044 |
4 | Chelsea | 1,218,040 |
5 | Arsenal | 1,066,837 |
6 | Real Madrid | 663,833 |
7 | Pittsburgh Steelers | 503,219 |
8 | Rangers | 478,901 |
9 | Philadelphia Eagles | 474,904 |
10 | Dallas Cowboys | 418,439 |
Among sports, ‘football’, ‘baseball’ and ‘soccer’ are the top three most popular sports used in passwords.
‘Football’ appears 2,603,807 times, while ‘baseball’ appears 1,937,815 times and ‘soccer’ appears 1,769,491 times.
Rank | Password | Number of times used |
1 | Football | 2,603,807 |
2 | Baseball | 1,937,815 |
3 | Soccer | 1,769,491 |
4 | Basketball | 1,200,664 |
5 | Hockey | 889,460 |
The most-used famous names and pop culture references in passwords
‘Blink-182’ is the most commonly used famous pop culture-related password, appearing 1,654,660 times.
Metallica follows closely behind, appearing 1,128,022 times. Other common pop culture references include Eminem, Ronaldo, Nirvana and 50 Cent.
Rank | Password | Number of times used |
1 | Blink-182 | 1,654,660 |
2 | Metallica | 1,128,022 |
3 | Eminem | 974,001 |
4 | Ronaldo | 890,771 |
5 | Nirvana | 885,818 |
6 | 50 Cent | 544,834 |
7 | Einstein | 360,155 |
8 | Madonna | 338,263 |
9 | Napoleon | 336,792 |
10 | The Beatles | 288,121 |
The most-used fictional characters in passwords
Among fictional characters, ‘Superman’ is the most common password choice, appearing 2,134,813 times.
‘Naruto’ follows in second, appearing 1,643,637 times, while ‘Batman’ ranks third, appearing 1,338,840 times.
Rank | Password | Number of times used |
1 | Superman | 2,134,813 |
2 | Naruto | 1,643,637 |
3 | Batman | 1,338,840 |
4 | Tigger | 1,309,873 |
5 | Snoopy | 1,071,875 |
6 | Spider-Man | 1,050,152 |
7 | Mickey | 906,561 |
8 | Garfield | 674,625 |
9 | SpongeBob | 635,263 |
10 | Sasuke | 514,391 |
The most-used animals in passwords
Animal-related passwords are also common, with ‘monkey’ appearing as an exact password 3,963,423 times.
‘Butterfly’ follows in second, appearing 1,176,152 times, while ‘chicken’ appears 917,838 times.
Rank | Password | Number of times used |
1 | Monkey | 3,963,423 |
2 | Butterfly | 1,176,152 |
3 | Chicken | 917,838 |
4 | Scorpion | 802,076 |
5 | Spider | 689,357 |
6 | Elephant | 670,030 |
7 | Dolphin | 590,520 |
8 | Rabbit | 498,998 |
9 | Turtle | 452,143 |
10 | Tiger | 382,084 |
The most-used plants in passwords
Among plants, fruits and vegetables, ‘orange’ is the most common password choice, appearing 1,127,398 times.
‘Banana’ follows in second, appearing 1,122,955 times, while ‘flower’ ranks third, appearing 1,102,190 times.
Rank | Password | Number of times used |
1 | Orange | 1,127,398 |
2 | Banana | 1,122,955 |
3 | Flower | 1,102,190 |
4 | Pepper | 1,097,328 |
5 | Jasmine | 1,048,559 |
6 | Apple | 523,185 |
7 | Cherry | 513,544 |
8 | Pumpkin | 466,531 |
9 | Willow | 445,841 |
10 | Sunflower | 426,980 |
The most-used objects in passwords
Among everyday objects, ‘computer’ is the most common password choice, appearing 2,422,759 times.
‘Diamond’ follows in second, appearing 1,001,879 times, while ‘silver’ ranks third, appearing 881,203 times.
Rank | Password | Number of times used |
1 | Computer | 2,422,759 |
2 | Diamond | 1,001,879 |
3 | Silver | 881,203 |
4 | Money | 689,384 |
5 | Guitar | 612,539 |
6 | Hammer | 418,263 |
7 | Home | 340,918 |
8 | Rocket | 306,376 |
9 | Monitor | 241,162 |
10 | Laptop | 212,947 |
Heath Alexander-Bew, personal lines director at Alan Boswell Group, commented on the findings: “Weak passwords can feel like a small issue, but they can cause problems very quickly, whether it is a personal email account or a workplace system. For individuals, it could mean someone accessing shopping accounts, banking apps or social media. For a business, it could open the door to invoices, customer details, internal files or password reset links for other platforms.
“What is worrying about these passwords is that many of them are not really being guessed. They are already sitting in leaked password lists, and criminals can use automated tools to try them across different sites. That is why passwords like ‘123456’, ‘admin’, a football team, a name or a birth year can still be risky, especially when people reuse them across work and personal accounts.
“The financial side of this should not be ignored either. The latest UK Government Cyber Security Breaches Survey found that 43% of businesses identified a cyber breach or attack in the last year, equal to around 612,000 UK businesses. While many incidents cost less, the most serious cases can climb quickly, with the top 5% of businesses reporting at least £4,000 in perceived costs for their most disruptive breach or attack. For medium and large businesses, that figure rises to at least £10,000.
“The safest approach is to stop relying on passwords that feel easy to remember. Businesses should block the most common leaked passwords, use multi-factor authentication and encourage staff to use password managers. Individuals should do the same for their personal accounts, especially email, banking and shopping logins. It is also worth checking recovery details and forwarding rules after changing a password, because if someone has already been inside an account, changing the password alone may not fully solve the problem.
For more info, visit https://www.alanboswell.com/business-insurance/commercial-insurance/cyber-insurance/
