Easy-to-guess passwords have cybersecurity experts clamoring for an evolution

SALT LAKE CITY — Passwords have protected our online lives for decades. But cybersecurity experts say they are on their way out.

We have been told for years to make passwords stronger and we, largely, have not listened.

A new analysis from the Alan Boswell Group looked at data from Have I Been Pwned to figure out which passwords are being reused and how often.

The most common password is "123456." It appeared nearly 210 million times.

"Password" appeared more than 52 million times. "Admin" appeared 42 million times. And "qwerty," the first six letters across the top of your keyboard, appeared more than 30 million times.

The list gets more personal, but still guessable for a hacker, especially if you share personal things on social media.

Among names, Daniel was the most commonly used as a password.

Football topped sports. Liverpool topped sports teams. Superman topped fictional characters.

And nearly 4 million exposed passwords were simply "monkey."

"What is worrying about these passwords is that many of them are not really being guessed," said Heath Alexander-Bew, personal lines director at Alan Boswell Group. "They are already sitting in leaked password lists, and criminals can use automated tools to try them across different sites."

Alexander-Bew says the safest approach is to stop relying on passwords that feel easy to remember.

"Businesses should block the most common leaked passwords, use multi-factor authentication and encourage staff to use password managers," he said. "Individuals should do the same for their personal accounts, especially email, banking and shopping logins. It is also worth checking recovery details and forwarding rules after changing a password, because if someone has already been inside an account, changing the password alone may not fully solve the problem."

Those realities have the information-technology world going through a revolution, says Kathryn Linford, who owns Insight IT.

"Passwords are becoming obsolete," Linford said. "They're not really the best method for authenticating anymore."

Until passwords finally ride off into the digital sunset, Linford says people should not try to remember dozens of strong, unique passwords themselves, agreeing that password managers are a useful tool.

"You don't have to remember your passwords," she said. "You can put safe passwords in everything. They're going to be hard to use. They're gonna be hard to remember."

People also should not ignore warning signs that they have been breached, she said.

"All the time you're getting these notifications, you're getting texts, you're getting emails, you're getting all of this information coming through."

The KSL Investigators previously reported on some of those warning signs.

Linford expects that passkeys, fingerprints, face scans and trusted devices that prove you are you without making you remember another string of letters, numbers and symbols will become more commonplace and likely replace passwords for many institutions.

Related topics