Passwords. What makes them bad?

It is not just the words in a password. It is how they are used, what context they are used in, if they have been exposed online, and other factors.

Here are the top 15 worst passwords

1. admin (or admin with only a few extra characters like admin1, admin!, adminX)
2. password2024 (and iterations of it, such as 2023Password)
3. password (and iterations of it, such as password1, password123, p4ssword)
4. p4ssw0rd (or other common leetspeak variations)
5. 12345 (and iterations of it, such as 123456, 1234567, 12345678, 123456789)
6. 654321 (reversed versions of common passwords)
7. Iloveyou
8. qwerty (and iterations of it, such as qwerty1, qwerty!, qwerty123, etc.)
9. 1111111 (and others like it with sequential characters, such as 222222, 3333333, 4444444, 5555555, etc.)
10. 123123 (and iterations of it, such as 12341234, 1234512345, 321321, etc.)
11. abc123 (and iterations of it, such as abcd123, abcd1234, 321cba, etc.)
12. asdfgh (and iterations of it, such as asdfghj, asdfgh!, etc.)
13. Website name (passwords that contains the site name. ie: www.acmecompany.com and the password is acmecompany)
14. Any common word in the dictionary less than 8 characters
15. Lastly, compromised passwords that have been exposed along with your username!

Online Users:

A strong password isn’t necessarily a safe password. Although many passwords meet typical algorithmic strength requirements, they may still be unsafe if they exist in password cracking dictionaries used by cybercriminals.

You can see if a sample password is generally safe, weak, or compromised here.

Organizations:

Don’t let your employees use weak or compromised passwords!

You can enable quick-to-deploy automated password policy enforcement and daily exposed password screening in Active Directory. With fully automated weak password filtering, fuzzy password matching, password similarity blocking, and custom password dictionary filtering; enterprises can easily adopt NIST password requirements and secure employee passwords.

If you want to learn how to block similar passwords and screen your Active Directory accounts daily for compromised passwords, read our paper on how to solve the password problem.

To see how it can work, review this paper from Cybersecurity Insider.