Worst passwords of 2017: From '123456' to 'starwars'
Using any of the logins on the list would put you 'at grave risk for identity theft'
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.The worst passwords of the year have been revealed in a new report.
“123456” tops the list, as it did in 2016, 2015, 2014 and 2013. For the fourth consecutive year, the next entry on the list is “password”. Variations of each of them comprise six of the other 23 entries in the top 25.
“12345678”, “qwerty” and “12345”, meanwhile, complete the top five.
“Use of any of the passwords on this list would put users at grave risk for identity theft,” said SplashData, which released the report.
The company says it “estimates that almost 10 per cent of people” have used at least one of this year’s selection of the 25 worst passwords, and “nearly 3 per cent of people” have used the outright worst password, 123456.
It adds that the passwords evaluated for the report were mostly held by people in North America and Western Europe.
“These past two years have been particularly devastating for data security, with a number of well publicized hacks, attacks, ransoms, and even extortion attempts. Millions of records have been stolen,” said SplashData.
The 2017 edition of the list was compiled from more than five million passwords that leaked during the year. However, any login details that leaked as a result of the enormous Yahoo email breach and hacks of adult websites were not considered for the report.
SplashData recommends using passwords that are at least 12 characters long, comprising a mix of different character types and both upper- and lowercase letters.
The company says you should also use a different password for each of your logins. This, however, can cause a completely different set of problems, as it can be tough to remember multiple logins.
You can save yourself some hassle by signing up to a password manager.
“Hackers know your tricks, and merely tweaking an easily guessable password does not make it secure,” said SplashData CEO Morgan Slain.
“Our hope is that our Worst Passwords of the Year list will cause people to take steps to protect themselves online.”
The 25 worst passwords of the year are:
- 123456 (unchanged from 2016 list)
- password (unchanged)
- 12345678 (up one place)
- qwerty (up two places)
- 12345 (down two places)
- 123456789 (new entry)
- letmein (new entry)
- 1234567 (unchanged)
- football (down four places)
- iloveyou (new entry)
- admin (up four places)
- welcome (unchanged)
- monkey (new entry)
- login (down three places)
- abc123 (down one place)
- starwars (new entry)
- 123123 (new entry)
- dragon (up one place)
- passw0rd (down one place)
- master (up one place)
- hello (new entry)
- freedom (new entry)
- whatever (new entry)
- qazwsx (new entry)
- trustno1 (new entry)
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments