We all know how important it is to remember your password. Whether it’s for your email account, your website admin password, or just for your TikTok account, your password is stops others from accessing your account.
And whilst 2FA and other authentication methods can improve security, a good password is often enough. So, why do people still opt for common passwords? Convenience, lack of awareness and a whole host of other reasons. We’re going to look at 50 of the most common passwords so you know which ones to avoid.
Top 50 Most Commonly Used Passwords
- 123456
- 123456789
- 12345
- qwerty
- password
- 12345678
- 111111
- 123123
- 1234567890
- 1234567
- qwerty123
- 000000
- 1q2w3e
- aa12345678
- abc123
- password1
- 1234
- qwertyuiop
- 123321
- password123
- 1q2w3e4r5t
- iloveyou
- 654321
- 666666
- 987654321
- 123
- 123456a
- qwe123
- 1q2w3e4r
- 7777777
- 1qaz2wsx
- 123qwe
- zxcvbnm
- 121212
- asdasd
- a123456
- 555555
- dragon
- 112233
- 123123123
- monkey
- 11111111
- qazwsx
- 159753
- asdfghjkl
- 222222
- 1234qwer
- qwerty1
- 123654
- 123abc
Five Rules for Creating Strong Passwords
1. At least 12 characters
The length of your password’s is the first line of defense. Every character you add exponentially increases the time needed to crack it. While 8 characters was once considered sufficient, today’s computing power makes 12 characters the minimum recommendation.
2. Mix of special characters, upper and lowercase letters, numbers and symbols
Diversity in character types dramatically increases complexity. For example instead of “password”, try “P@$$w0rd!” – though even this example uses predictable substitutions that sophisticated password crackers account for.
3. Uncommon, nonsensical combinations
Random combinations are harder to crack than dictionary words. A passphrase – a string of random words like “correct-horse-battery-staple” – which is both more secure and potentially easier to remember than a shorter complex password.
4. Remove personal information
Don’t use birthdates, pet names, family members or other personal details that can be found through social media or public records. These are often the first guess for chancers trying to access your account.
5. Don’t reuse username as password
Using your email or username as your password is basically giving hackers half of your login credentials, though unfortunately it’s still a common practice.
6. Consider password entropy
This technical term means how unpredictable your password is. Higher entropy means greater security. Random passwords generated by password managers typically have high entropy.
7. Different passwords for different accounts
This one is tough, but ideally each online account should have a unique password. This can be beneficial because even if one account is compromised, others remain secure. This is especially important for high value accounts like banking, email and your WordPress admin area.
8. Update after sharing
If you share a password with a colleague, contractor or even a family member, change it immediately afterwards – even if you trust the person completely.
9. Respond to breach notifications immediately
Nowadays there are services and browsers that will notify us when our account has been breached – if this happens, change that password immediately, along with any similar passwords you use elsewhere.
10. Use a Password Manager
Instead of spreading passwords across sticky notes, text files or your memory, a password manager provides a secure, encrypted vault accessible with a single master password or biometric authentication.
Top 10 WordPress Password Managers
- Password Protect WordPress: Password Protect WordPress (PPWP) allows you to protect frontend content with passwords, letting you password-lock specific pages, posts, or custom post types without affecting your entire site.
- Wordfence Security: Wordfence Security monitors login attempts, blocks suspicious IP addresses, and alerts you to breaches involving your admin credentials. It also includes a firewall, malware scanner, and live traffic monitoring.
- Temporary Login without Password: Temporary Login without Password provides secure, time-limited access to contractors, developers, or support staff without compromising your site’s security.
- Password Policy Manager: Password Policy Manager allows you to enforce strong admin passwords that require minimum password lengths, mandate special characters, and even implement complexity scoring to make sure that your passwords across all user accounts are strong enough.
- Solid Security: Create 2FA authentication and strong passwords with brute force protection, malware scanning, and database backups.
- Use Admin Password: Allow admins to log in as user with admin passwords. If you manage sites with multiple user accounts that you need to keep track of, this can be very helpful.
- All In One WP Security & Firewall: Add extra security and firewall to WordPress that goes beyond password management, creating multiple layers of defense around your WordPress site.
- Emergency Password Reset: Emergency Password Reset is useful when normal password recovery methods fail—whether your email system is down, you’ve lost access to your recovery address, or your database has become corrupted, this plugin provides a direct method to reset user credentials without going through the standard recovery workflow.
How Can PPWP Pro Help You Create Strong Passwords?
- Protect any types of WordPress content with passwords
- Auto-generate strong passwords or create custom passwords
- Configure user roles to use the passwords
- Create multiple passwords for a single post or page
- Use one single password for multiple content
- Manage passwords in one place with a password manager
- Expire passwords automatically by password usage limit and expiry time
