Jan 20, 2026 • ESET WeLiveSecurity
Old habits die hard: 2025’s most common passwords were as predictable as ever
Analysis of 2025 password data reveals that users continue to rely on weak, easily guessable passwords despite widespread awareness of cybersecurity risks....
Executive Summary
Analysis of 2025 password data reveals that users continue to rely on weak, easily guessable passwords despite widespread awareness of cybersecurity risks. Common passwords such as '123456', 'password', and predictable patterns remain prevalent across platforms. This persistent behavior creates significant vulnerabilities for credential-based attacks, including brute force and credential stuffing. Weak passwords serve as an easy entry point for threat actors to gain unauthorized access to accounts and systems. Organizations should enforce strong password policies, implement multi-factor authentication (MFA), and conduct regular security awareness training to mitigate the risks associated with poor password hygiene.
Summary
Once again, data shows an uncomfortable truth: the habit of choosing eminently hackable passwords is alive and well
Published Analysis
Analysis of 2025 password data reveals that users continue to rely on weak, easily guessable passwords despite widespread awareness of cybersecurity risks. Common passwords such as '123456', 'password', and predictable patterns remain prevalent across platforms. This persistent behavior creates significant vulnerabilities for credential-based attacks, including brute force and credential stuffing. Weak passwords serve as an easy entry point for threat actors to gain unauthorized access to accounts and systems. Organizations should enforce strong password policies, implement multi-factor authentication (MFA), and conduct regular security awareness training to mitigate the risks associated with poor password hygiene. Once again, data shows an uncomfortable truth: the habit of choosing eminently hackable passwords is alive and well Once again, data shows an uncomfortable truth: the habit of choosing eminently hackable passwords is alive and well