Are You Using a Weak Password? Here are 2019’s Worst Passwords

A weak password can bring down even the strongest of your practice’s computer security defenses. Passwords are the cornerstone of all modern computer security practices. Because of that, they are one of the most highly sought after targets for attackers. When breaches occur, attackers often post the account information they steal online or on Dark Web sites for sale. Security researchers compile these lists of accounts and find out what users have actually chosen for their passwords. The results are often very shocking and disappointing. This is why we can’t have nice things. Here are the top 200 weak passwords for 2019, as chosen by real users.

Top 200 weak passwords for 2019

How as this list made?

NordVPN, a popular virtual private networking (VPN) service, compiled this list from dozens of reported breaches in 2019. They compared all of the data from these breaches and found common passwords that many people were using. The database itself contains over 500 million passwords in total.

In the first half of 2019, more than 4 BILLION records were exposed or stolen because of data breaches. In December of this year, a security researcher found a further billion passwords that were unencrypted stored in an insecure database. This database was live on the internet.

Breaches are common and it’s usually a matter of when rather than if.

What makes a password weak or strong?

Weak passwords are those that are easy for an attacker to break. These include the passwords in the list above. All of these have the same characteristics. These include:

• Passwords less than 8 characters long
• Not using both upper and lower letters
• Not using numbers
• Using common or easily guessed passwords – if it’s in the English language, you shouldn’t be using it

Another bad habit many users have is to use the same password on many different websites or computers. The password is easy to remember so it makes using it everywhere easier. However, once a weak password is compromised, the attacker can use that password to gain access to all the accounts that the password was used on. Using a unique password for every website, account, phone, etc. is critical.

We have written an extensive page on how to create strong passwords that can be read here. However, for a quick and dirty explanation, try this method. Choose 4 or more random words together. For example:

horse carrot thermometer pipe

That password is 26 characters long. If you added a number, capitalized one of the letters, and added a special character, you would have a very strong password that is virtually impossible to break. It’s also easy to remember.

One of the best ways to ensure you always use strong passwords is with a password manager. LastPass is an example of a free password manager that is very easy to use. LastPass will generate unique passwords for each of your online accounts and make them completely random. This ensures that you aren’t using the same password over and over again. It also makes sure you are creating very strong and unbreakable passwords. LastPass stores your passwords in an encrypted database that even it can’t access.

LastPass is free and can be found here.