Loading story…
A recent analysis of over two billion leaked passwords revealed that easily guessable and weak passwords such as 123456, admin, and password remain among the most commonly used worldwide. Variations like Aa123456, Aa@123456, and sequential keyboard patterns such as qwerty and 1q2w3e4r also feature prominently in the top 100, highlighting persistent poor password hygiene among users. The study found that a quarter of the most common passwords consist solely of numbers, and 38% contain the string 123, making them highly susceptible to brute-force and guessing attacks.
Complementing these findings, research into the top 1,000 most-visited websites showed that 42% have no minimum password length requirements, and only five enforce strong password policies that include length, special characters, and case sensitivity. Additionally, 11% of these sites have no password creation requirements at all, and only 2% support passkeys as a secure alternative. The lack of robust password enforcement on major websites, especially in sectors like government and healthcare, perpetuates the use of weak passwords and increases the risk of account compromise.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
SC Media reported that nearly half of the top 1,000 websites had no password length requirements, underscoring weak password policy enforcement across major online services.
Comparitech published its 2025 study showing that highly predictable passwords such as "123456," "admin," and "password" remain common, with many top passwords consisting of numeric strings or containing "123." The findings highlighted ongoing poor password hygiene and prompted recommendations for passkeys, long passphrases, password managers, and stronger organizational password policies.
Comparitech conducted a 2025 analysis of more than two billion passwords exposed on breach forums to identify the 100 most common passwords and broader password-use patterns.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent research highlights the persistent risk posed by weak passwords, with modern password cracking tools able to compromise a significant portion of real-world credentials in under an hour. Analysis of over 190 million passwords reveals that nearly 60% can be cracked within sixty minutes, largely due to the power of contemporary GPUs and advanced brute-force and dictionary attack techniques. Security experts emphasize the importance of adopting stronger authentication strategies, such as using passphrases and password managers, to mitigate these risks and prevent unauthorized access to sensitive systems and data. Longitudinal studies of leaked password datasets from 2007 to 2025 show that user habits and password strength have improved over time, particularly following major breach events and the introduction of stricter password policies. The adoption of machine-generated passwords and built-in password managers in operating systems has contributed to measurable progress, though a minority of users still rely on weak, easily guessed credentials. Security professionals recommend continued education and the implementation of advanced password management tools to address remaining gaps and further strengthen enterprise security posture.
Jun 29, 2026
A new report from password manager 1Password highlights that weak or compromised passwords remain a significant security risk for organizations, with employee password practices worsening despite increased awareness. Survey data from over 5,000 workers across multiple countries reveals that a majority of employees, including IT professionals, continue to reuse passwords, rely on default credentials, or share passwords via insecure channels, exacerbating the threat landscape for businesses. The report underscores that even as companies move toward passwordless authentication, the transition is gradual and current credential management practices are not keeping pace with evolving threats. In response to these challenges, technology vendors are accelerating the adoption of passwordless solutions. Microsoft has released Edge version 142.0, introducing cross-platform passkey synchronization, allowing users to securely reuse passkeys across devices and browsers. This feature, which requires a dedicated PIN for access, aims to enhance both security and usability, reducing reliance on traditional passwords. The move reflects a broader industry trend toward passkeys and multi-factor authentication as default options, with major platforms like Google and Meta also embracing passwordless technologies to mitigate the risks associated with password-based authentication.
Jun 29, 2026
Testing by AI security firm **Irregular** found that passwords generated by popular LLMs (including **ChatGPT**, **Claude**, and **Google Gemini**) are often *highly patterned and non-random*, making them more guessable than they appear and potentially useful additions to attacker wordlists for dictionary and targeted brute-force attacks. In repeated prompting experiments, Irregular observed substantial duplication and structural consistency (e.g., repeated prefixes/suffixes and other recurring formats), indicating the outputs are driven by token-prediction behavior rather than uniform randomness; this can mislead users because the strings may look complex and can score “strong” in common password-strength checkers that don’t account for LLM-specific generation patterns. The reporting emphasized that defenders should avoid using LLMs as password generators and instead rely on *password managers* and OS-backed **cryptographic random number generators** that incorporate real entropy to produce unpredictable passwords. Separate commentary also argued for stronger authentication posture overall—prioritizing **phishing-resistant MFA** and longer, truly random passwords or passphrases when passwords must be used—while noting that many real-world credential compromises stem from theft (social engineering, malware, or exploitation) rather than pure guessing, making MFA and secure credential handling critical alongside password complexity guidance.
Jun 29, 2026