Become a MacRumors Supporter for $25/year with no ads, private forums, and more!
  • Did you order new AirTags? We've opened a dedicated AirTags forum.

MacRumors

macrumors bot
Original poster
Apr 12, 2001
52,446
14,146



SplashData published its annual list of the worst passwords of the year this week, sourced from more than five million passwords leaked on the internet this year. Like previous years, 2018 saw numerous high-profile data leaks, but many people have continued to use easily guessable passwords for their online accounts.

autofillpasswordssetup.jpg
The new password autofill feature in iOS 12


For the fifth consecutive year, "123456" and "password" are the top two most popular passwords online. New entries on the list include "111111", "sunshine", "princess", "666666", "654321", and "donald" at number 23. SplashData CEO Morgan Slain discussed the list: "Hackers have great success using celebrity names, terms from pop culture and sports, and simple keyboard patterns to break into accounts online because they know so many people are using those easy-to-remember combinations."

The top 10 most popular passwords of 2018:

1) 123456
2) password
3) 123456789
4) 12345678
5) 12345
6) 111111
7) 1234567
8) sunshine
9) qwerty
10) iloveyou

Higher up the list, popular passwords include people's names like "daniel", "hannah", and "thomas"; pop culture references like "solo", "tigger", and "lakers"; random items like "cookie" and "banana"; birth years like "1990" and "1991"; and simple phrases like "whatever" and "test". As Slain explained, using super-simple phrases like these for any account online is a bad idea because it's so easy to guess what they are.
"Our hope by publishing this list each year is to convince people to take steps to protect themselves online," says Slain. "It's a real head-scratcher that with all the risks known, and with so many highly publicized hacks such as Marriott and the National Republican Congressional Committee, that people continue putting themselves at such risk year-after-year."
In total, SplashData estimated that almost 10 percent of people have used at least one of the top 25 worst passwords on this year's list, and nearly 3 percent of people have used the worst password at one time, "123456". Most of the five million passwords that were leaked and evaluated for the report came from users in North America and Western Europe.

To help users stay safe, SplashData said that their passwords should be no shorter than twelve characters and have mixed types of characters in each one. Every log-in should have a different password, and investing in a password management app to store everything, generate random new passwords, and automatically log into websites is always a good idea.

Apple itself introduced a new password autofill feature in iOS 12 this year, making it easy to connect to third-party password apps and fill out your passwords throughout iOS. If you haven't tried it out yet, check out our guide on using the feature to find out how it works.

Article Link: '123456' and 'Password' Remain Worst Passwords of the Year for Fifth Consecutive Year
 

AngerDanger

macrumors 603
Dec 9, 2008
5,164
26,061
How are people managing to get away with such simple passwords? I take the XKCD approach to password creation—a sentence comprised of nonsensical but easy to remember words. By the time I get done setting up an account, however, I've had to add a number, a capital letter, and a symbol. They only make my originally strong password harder for me to remember.

password_strength.png
 
Comment

Dekema2

macrumors 6502a
Jul 27, 2012
845
421
WNY or Utica
I don't understand why people put the least amount of effort into securing the most vulnerable parts of their lives.
 
Comment

brofkand

macrumors 6502a
Jun 11, 2006
504
989
Free password managers like iCloud Keychain, Bitwarden, etc., make remembering passwords obsolete. There is no excuse to have poor passwords in 2018.
[doublepost=1544799583][/doublepost]
How are people managing to get away with such simple passwords? I take the XKCD approach to password creation—a sentence comprised of nonsensical but easy to remember words. By the time I get done setting up an account, however, I've had to add a number, a capital letter, and a symbol. They only make my originally strong password harder for me to remember.

password_strength.png
That was great advice before the advent of cross platform secure password managers, but today I'd say using a password manager to generate a random high entropy password is a better solution, ideally coupled with a second factor for sensitive data like banking or sites with payment methods attached.
 
Comment

EdT

macrumors 68000
Mar 11, 2007
1,906
1,613
Omaha, NE
The problem with the XKCD cartoon is companies saw his suggestion and wrote requirements for a valid password that mess up the idea. Such as, can’t have 2 numbers next to each other or they can’t be sequential or you must have one of a few specific characters in your password or you cannot have some characters etc.
 
  • Like
Reactions: page404 and Dj64Mk7
Comment

WannaGoMac

macrumors 68030
Feb 11, 2007
2,541
3,799
How did they collect the counts to make this list?
Looks like they just came up with the list of passwords themselves, no actual survey or counting from password leaks.
FUD
 
Comment

brofkand

macrumors 6502a
Jun 11, 2006
504
989
How did they collect the counts to make this list?
Looks like they just came up with the list of passwords themselves, no actual survey or counting from password leaks.
FUD

It's discussed in the article MacRumors linked to. In the first few sentences no less.
 
Comment

Xenomorph

macrumors 65816
Aug 6, 2008
1,332
637
St. Louis
I know it's overused (and mentioned already in this thread), but the reference still manages to pop up with IT at work.

1, 2, 3, 4, 5? That's amazing! I've got the same combination on my luggage!
 
  • Like
Reactions: dude-x and Unity451
Comment

WannaGoMac

macrumors 68030
Feb 11, 2007
2,541
3,799
It's discussed in the article MacRumors linked to. In the first few sentences no less.

When I click the link all i see is an article list of 100 passwords with pictures making fun of them, then a video to play (which I refuse to do).


edit: Looks like macrumors changed the URL link as now it goes to an article and not the direct list.

p.s. What moron thought light grey text on a white page was a good idea?
 
Comment

NinjaHERO

macrumors 6502a
Aug 29, 2008
934
1,128
U S of A
While I'd never use one of these passwords personally, I totally get some people's frustration. My job requires us to change multiple passwords every 3 months. At some point you get tired of making stuff up.
 
  • Like
Reactions: Mizouse
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.