[The Social Engineer]

Do you know what the top 20 weakest passwords in use are? Dare to take a guess at the top 5?  The results may surprise you.

---

DISCLAIMER:

This count is a compilation of a handful of HUGE (80 million to 800 million accounts) database leaks that I have come across over time. I have since removed any references to usernames and other critical data from these and now only use it as massive password library for dictionary attacks during pentesting. I am not giving this library away, sorry  🤝

---

Take a guess, post it in the comments below, then click the spoiler to see the results!

Click here to see! (Click to View)

**note that this probably only accounts for less than 10% of accounts in existance.

Code

top 20 commonly used passwords in the world:
--------------------------------------------
#)  # of accounts   password
--------------------------------------------
1)  5,248,067   123456
2)  1,909,336   123456789
3)  1,349,896   qwerty
4)  1,014,037   password
5)    788,055   abc123
6)    776,365   111111
7)    769,718   12345678
8)    693,655   password1
9)    669,774   1234567
10)   642,540   1234567890
11)   613,745   123123
12)   572,249   12345
13)   542,497   000000
14)   506,527   1q2w3e4r5t
15)   422,323   iloveyou
16)   361,118   qwertyuiop
17)   335,071   1234
18)   300,584   dragon
19)   298,477   monkey
20)   280,248   123456a

[nullvo1d]

society doesnt care about their privacy

[cryp]

I've used iloveyou as a gift for accounts to my fiancee. Never were changed. I guess I'm a victim to that onr haha.

[Bipo]

This is very good , let them do ;)

[Black Hat]

remember when life was simple and you could have the password 123456 for everything, those were the days.

[PerfectStorm]

Who would have guessed "password1" for example? why would so many people use that password. Strange.

[The Social Engineer]

remember when life was simple and you could have the password 123456 for everything, those were the days.

Truth be told, there were close to 90 million accounts that had either a blank password or " " as the password. I decidedly omitted these as I could not confirm if these were disabled accounts or a mistake during processing. IF those were actually set on those accounts, then technically - with a majority of users being a lazy bunch - don't set passwords when not enforced. 🤣

---

Who would have guessed "password1" for example? why would so many people use that password. Strange.

to paraphrase an old saying:

Like minds think alike...