WASHINGTON — Some people never learn. And, by the way, they’re not very creative.
The 2014 list of worst Internet passwords, as compiled by the security company SplashData, shows many users continue to put themselves at risk with weak, easily guessable passwords.
The worst password of the year, for the second year running: “123456.”
The annual report is compiled from more than 3.3 million leaked passwords during the year.
The second-worst password on the list: “password.”
“The bad news from my research is that this year’s most commonly used passwords are pretty consistent with prior years,” says security expert Mark Burnett, author of “Perfect Passwords.”
“The good news is that it appears that more people are moving away from using these passwords,” says Burnett. “In 2014, the top 25 passwords represented about 2.2% of passwords exposed. While still frightening, that’s the lowest percentage of people using the most common passwords I have seen in recent studies.”
As in past lists, simple numerical passwords remain common, with nine of the top 25 passwords composed of numbers only.
Any password using numbers alone should be avoided, especially sequences, says Morgan Slain, CEO of SplashData.
“As more websites require stronger passwords or combinations of letters and numbers, longer keyboard patterns are becoming common passwords, and they are still not secure,” says Slain.
Passwords appearing for the first time on the annual list are “696969,” “batman” and “access.”
Other tips from the list:
- Don’t use a favorite sport or team for a password — “baseball,” and “football” are in the top 10, while “hockey,” “soccer,” “golfer,” “yankees,” “eagles,” “steelers,” “rangers,” and “lakers” are all in the top 100.
- Don’t use your birthday or especially just your birth year — 1989, 1990, 1991, and 1992 are all in the top 100.
- Be careful using childrens’ names as passwords — “michael,” “jennifer,” “thomas,””jordan,””hunter,””michelle,””charlie,””andrew,” and “daniel” are all in the top 50.
SplashData’s list of “Worst passwords of 2014”
- 123456 (unchanged from 2013)
- password (unchanged)
- 12345 (up 17)
- 12345678 (down 1)
- qwerty (down 1)
- 1234567890 (unchanged)
- 1234 (up 9)
- baseball (new)
- dragon (new)
- football (new)
- 1234567 (down 4)
- monkey (up 5)
- letmein (up 1)
- abc123 (down 9)
- 111111 (down 8)
- mustang (new)
- access (new)
- shadow (unchanged)
- master (new)
- michael (new)
- superman (new)
- 696969 (new)
- 123123 (down 12)
- batman (new)
- trustno1 (down 1)
Follow @WTOP and @WTOPtech on Twitter and WTOP’s Facebook Page.
