The most leaked passwords in the world
Number of times each password appears in Have I Been Pwned’s database of breached passwords, checked on 12 October 2026:
| # | Password | Times leaked |
|---|
| 1 | 123456 | 210,461,208 |
| 2 | 123456789 | 81,108,282 |
| 3 | 12345678 | 70,606,130 |
| 4 | password | 52,372,427 |
| 5 | admin | 42,266,086 |
| 6 | 12345 | 31,107,081 |
| 7 | qwerty | 30,812,897 |
| 8 | 1234567 | 19,869,781 |
| 9 | 1234567890 | 19,826,299 |
| 10 | 111111 | 15,943,793 |
| 11 | 123123 | 15,088,143 |
| 12 | qwerty123 | 13,871,714 |
| 13 | abc123 | 12,994,280 |
| 14 | 000000 | 12,866,377 |
| 15 | password1 | 9,643,893 |
They are number sequences, keyboard walks (qwerty, and 1q2w3e4r with 7.3 million) and the word password itself.
Names, teams and words
Beyond number strings, the same kinds of words turn up again and again:
| Password | Times leaked | Type |
|---|
| iloveyou | 7,007,935 | Affectionate phrase |
| dragon | 4,415,380 | Common word |
| monkey | 3,964,183 | Common word |
| football | 2,605,147 | Hobby |
| welcome | 2,474,128 | Common word |
| michael | 2,332,542 | First name |
| superman | 2,136,340 | Pop culture |
| liverpool | 1,790,671 | Football team |
| ashley | 1,727,971 | First name |
| blink182 | 1,655,939 | Band |
| chocolate | 1,559,842 | Common word |
| chelsea | 1,218,619 | Football team |
Names, teams, bands, pets and words of love: exactly what someone who knows you, or who has looked at your social media, would try first.
The ones that look complex
Meeting the “capital, number and symbol” rules does not get a password off the lists if it follows a human pattern:
| Password | Times leaked |
|---|
| P@ssw0rd | 6,421,042 |
| 1qaz2wsx | 5,832,052 |
| Password1! | 584,516 |
1qaz2wsx looks random until you look at a keyboard: it is the first two columns, top to bottom. A capitalized word followed by a year and a symbol is probably the most used pattern in the world for “meeting the requirements”, and attack tools know it.
Using something similar? Check how many times it appears in breaches, without sending your password.
Password checkerWhy it matters
Attackers do not try random combinations: they start with these lists, ordered from most to least frequent. A password that has appeared even once in a breach is part of that dictionary, however long it is. That is why current standards require services to reject any breached password.
The fix is the usual one: randomly generated passwords, one per account, kept in a password manager.
Where the data comes from
From Pwned Passwords, Troy Hunt’s public service that collects passwords exposed in data breaches. For each password we looked up its SHA-1 fingerprint using k-anonymity, the same method our checker uses. The count is appearances in breaches, not distinct people: the same person may have used the same password on several breached services.
Data checked on 12 October 2026. The counts grow with every new breach that gets added.