15 Most Common Passwords To Avoid and How To Stay Secure

Despite the constant warnings and recommendations to use strong passwords, millions of people still use either a simple, guessable password or the default password automatically assigned to a device to protect their online accounts. While this may be temporarily convenient, it leaves many businesses’ accounts vulnerable to hackers and cyberattacks. As login credentials are often the first line of defense for many systems, it’s critical that organizations leverage strong, unique passwords that can evade the tactics of hackers. 

NordPass explored the most commonly used passwords in their 2025 study. These passwords are often the vulnerability hackers seek out when attempting to gain access to someone else’s account. If you find your password on the list, you should immediately change it to prevent any unauthorized usage of your systems, devices, or platforms.

What Is a Weak Password?

A weak password is a password that can be easily guessed, predicted, or cracked because it uses common words, predictable patterns, personal information, or frequently used character combinations. Weak passwords increase the risk of unauthorized account access. Unique, longer passwords and additional authentication measures provide greater protection for personal and business accounts.

15 Common Weak Passwords To Avoid

So, let’s look at the fifteen most common (and consequently worst) passwords used in 2025:

1. 123456
2. admin
3. 12345678
4. 123456789
5. 12345
6. password
7. Aa123456
8. 1234567890
9. Pass@123
10. admin123
11. 1234567
12. 123123
13. 111111
14. 12345678910
15. P@ssw0rd

How To Create Strong, Secure Passwords

Using a basic, easy-to-guess password like one from this list makes your account more susceptible to hacking and weakens the security of your network. To combat this weakness, businesses should employ strong passwords and password protection practices. 

Below, we’ve outlined two of the best ways to ensure your passwords are unique and reinforced with additional cybersecurity practices. 

Avoid Default Passwords

Default passwords are automatically assigned to accounts or devices out of the box. Because they are uniformly used across all devices, they’re easy to guess and extremely weak. “Admin”, a default password that ships on internet connected devices and web-based applications, is not only a common default password, but also a common overall password, making the above list at #2. 

As easy as this password is to guess, it’s even easier to change. To avoid having a default password be a weak link in your company’s security, make sure to change all devices, accounts, or other systems that have default passwords assigned to a unique password. 

If you’re having difficulty coming up with a strong password for your account, try this password generator by LastPass. 

Use Multifactor Authentication

As one of the best cybersecurity practices to implement, multifactor authentication (MFA) requires users to verify their identity with more than just a password. This can include confirming it via a code sent to a computer or mobile device, a specific question that only the account owner would know, or any other additional confirmation of ownership. To reinforce the strength of your passwords, make sure to enable multifactor authentication whenever it is available. MFA enabled on the accounts used for your business can protect you if one of your employees fails to set a strong password and instead uses a weak or predictable one. 

Password Security Best Practices for OpenEye Web Services

OpenEye Web Services (OWS) gives you a better return on your video security investment by reducing risk around your platform, helping to protect you and your business against hackers and cyberattacks. 

OWS employs the latest in cybersecurity practices like MFA, no open inbound ports, fully encrypted communication, and centralized user credentialing to safeguard your network and protect your data. To ensure that OpenEye devices use unique passwords, all OpenEye cameras and recorders automatically assign or require users to create a new password during initial setup.  

Book an OWS demo today to learn more about how OpenEye’s commitment to cybersecurity and data protection reinforces network security while lessening the burden on IT and operations. 

FAQs: Most Common Passwords

What are the most commonly used passwords?

The most commonly used passwords are “123456,” “admin,” “12345678,” “123456789,” and “12345.” These passwords are highly vulnerable to cyberattacks and should not be used.

Why are common passwords considered unsafe?

Login credentials are the one of the most common ways hackers attack personal and business account data. Because of this, a common password that is easily guessable will usually be the first method many hackers use to gain unauthorized access to an account.

What are the biggest risks of using weak passwords?

A weak password poses both a risk to individual account data and broader network security. This is accomplished through lateral movement, where hackers will use additional techniques to progress through a network and find further vulnerabilities they can exploit.

How do hackers identify and exploit weak passwords?

Hackers can identify weak passwords through multiple methods, though two common tactics are attempting access with common or default credentials or through social engineering tactics such as phishing. The latter method can be used to gain access to personal data, so account owners should be wary of any unexpected requests for passwords or sensitive information, even from those within their organization.

What makes a password strong and secure?

Strong passwords can be created by first avoiding default and commonly used passwords. Password generators from trusted cybersecurity sources, such as LastPass, can be helpful to create unique, complex strings of characters that aren’t easily guessed. Multifactor authentication is an additional cybersecurity best practice that helps protect account data through a required second mode of verification alongside login credentials.