Worst Passwords of 2016 Reveal We Just Don't Get It

The list of the worst passwords, as determined by SplashData is in and it’s not pretty. The worst offenders of the past continue to hold their places at the top, unfortunately. Obviously, we as a society are not paying attention. In fact, reportedly Hilary Clinton’s campaign chairman, John Podesta used the second worst password of “password” which may have allowed hackers to infiltrate the Democratic candidate’s network.

SplashData gathered up more than five million passwords that were leaked throughout 2016. Most of them were from North America and Western Europe. Of those making the list the ones we see over and over made up more than 10% of the survey. Worst of all, “123456” was 4% all by itself, making it the worst password of the year.

Variations of the familiar string of numbers always make the list. The idea is to create passwords that are not easy to guess, like “qwerty,” which is always one of the worst passwords of every year and indeed it appears this year as well, in the number six spot.

When creating passwords, be original and don’t use one that has already been used like all of these worst ones. Use combinations of upper and lower letters and numbers and add a special character or two. These can be found on the top row of the number keys, as well as some others like the question mark or brackets. Basically, anything that isn’t a number or a letter can be used as a special character in most password combinations.

Don’t use dictionary words either. Those are easy to figure out with a brute force dictionary attack. These are attacks that can be automated, where combinations of words are tried until something works. The longer the password, the longer it will take to crack it also, so always make your passwords at least eight characters. If your password isn’t a word, it makes it exponentially more difficult to crack, because, well it isn’t a word that can be found in the dictionary.

The top 25 worst passwords from number 25 to number 1 are:

25. password1
24. zaq1zaq1
23. loveme
22. hottie
21. master
20. sunshine
19. dragon
18. passw0rd
17. flower
16. 121212
15. admin
14. abc123
13. solo
12. welcome
11. login
10. 1234
  9. princess
  8. 1234567
  7. 1234567890
  6. qwerty
  5. football
  4. 12345678
  3. 12345
  2. password
  1. 123456

Note that there are some upbeat newcomers to the list, such as flower and sunshine. While it’s somewhat refreshing to see new words, it doesn’t make them better passwords. In fact, these don’t even include an upper case letter. And while “football” is the most watched sport on television in the US, it’s also the fifth worst password. So don’t bother to use it. It’s been taken already.