# 32 million passwords exposed. Most popular....123456 **URL:** \ **Category:** In My Humble Opinion\ **Created:** [April 13, 2010, 7:19pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977 "2010-04-13T19:19:17Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![fusoya](https://avatars.discourse-cdn.com/v4/letter/f/ecccb3/32.png) [@fusoya](https://boards.straightdope.com/u/fusoya)\ **Post date:** [April 13, 2010, 7:19pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/1 "2010-04-13T19:19:17Z")
[Story here.](http://www.net-security.org/secworld.php?id=8742). Top 10 most used passwords: 1. 123456 2. 12345 3. 123456789 4. Password 5. iloveyou 6. princess 7. rockyou 8. 1234567 9. 12345678 10. abc123 How the heck did rockyou get in there??? So how strong is your doper password? Mine actually falls into the majority, with only lower case, 6 characters (but not a word in any language) the same password I use for most low-security login sites. Stuff that would cause real damage if it got breached, such as gmail and my bank account, get the upper/lower/number/! treatment. Seriously folks, there’s no good reason not to have a strong password (at the minimum, it should not be a word!). I work in IT, so I see lots of stupid passwords, and I’ve even correctly guessed them before. And half the time, it’s written on a post-it somewhere within view of the monitor. ---
**Author:** ![DiosaBellissima](https://avatars.discourse-cdn.com/v4/letter/d/a8b319/32.png) [@DiosaBellissima](https://boards.straightdope.com/u/DiosaBellissima)\ **Post date:** [April 13, 2010, 7:27pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/2 "2010-04-13T19:27:35Z")
My password I use for everything is one of four variations that all include: my middle school id number, four digits of my first phone number as a kid, and a random letter or two. ---
**Author:** ![Chickie](https://avatars.discourse-cdn.com/v4/letter/c/9de053/32.png) [@Chickie](https://boards.straightdope.com/u/Chickie)\ **Post date:** [April 13, 2010, 7:27pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/3 "2010-04-13T19:27:55Z")
Yeah, a lot of my coworkers in the past have used their children’s names as passwords. Or pets. Mine is a random array of lowercase, caps, and numbers. I’ve been using variants of it since college. A friend of mine advises creating a “key” that you’ll always remember- he uses two or three letters and a number. And then, when you write your password down, write 56 99 ABC or whatever. So the whole password is never written, and you are the only one who knows your key, which is inserted into the “99” space. Apparently, when he was in the military in the UK 30+ years ago, that’s how they did it? Or something like that. ---
**Author:** ![Ogre](https://avatars.discourse-cdn.com/v4/letter/o/ecb155/32.png) [@Ogre](https://boards.straightdope.com/u/Ogre)\ **Post date:** [April 13, 2010, 7:30pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/4 "2010-04-13T19:30:32Z")
I have two completely unrelated words, with several character substitutions. Pretty strong, I’d guess (although I’ve been using it for a LONG time, and it’s probably getting a bit worn around the edges). ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [April 13, 2010, 7:30pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/5 "2010-04-13T19:30:36Z")
> [@fusoya](#): > > How the heck did rockyou get in there??? The breach was for [rockyou.com](http://rockyou.com). ---
**Author:** ![KneadToKnow](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kneadtoknow/32/3999_2.png) [@KneadToKnow](https://boards.straightdope.com/u/KneadToKnow)\ **Post date:** [April 13, 2010, 7:30pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/6 "2010-04-13T19:30:37Z")
I’m curious about the graph near the top of the article linked by the OP. What does the distribution of upper case, lower case, numeric, and special characters in a password have to do with its length? Also, from an older source (Mark Burnett’s 2005 book “Perfect Passwords: Selection, Protection, Authentication,”) here’s a table of the “Top 500 Worst Passwords Of All Time”: ```auto N Top 1-100 Top 101–200 Top 201–300 Top 301–400 Top 401–500 1 123456 porsche firebird prince rosebud 2 password guitar butter beach jaguar 3 12345678 chelsea united amateur great 4 1234 black turtle 7777777 cool 5 pussy diamond steelers muffin cooper 6 12345 nascar tiffany redsox 1313 7 dragon jackson zxcvbn star scorpio 8 qwerty cameron tomcat testing mountain 9 696969 654321 golf shannon madison 10 mustang computer bond007 murphy 987654 11 letmein amanda bear frank brazil 12 baseball wizard tiger hannah lauren 13 master xxxxxxxx doctor dave japan 14 michael money gateway eagle1 naked 15 football phoenix gators 11111 squirt 16 shadow mickey angel mother stars 17 monkey bailey junior nathan apple 18 abc123 knight thx1138 raiders alexis 19 pass iceman porno steve aaaa 20 fuckme tigers badboy forever bonnie 21 6969 purple debbie angela peaches 22 jordan andrea spider viper jasmine 23 harley horny melissa ou812 kevin 24 ranger dakota booger jake matt 25 iwantu aaaaaa 1212 lovers qwertyui 26 jennifer player flyers suckit danielle 27 hunter sunshine fish gregory beaver 28 fuck morgan porn buddy 4321 29 2000 starwars matrix whatever 4128 30 test boomer teens young runner 31 batman cowboys scooby nicholas swimming 32 trustno1 edward jason lucky dolphin 33 thomas charles walter helpme gordon 34 tigger girls cumshot jackie casper 35 robert booboo boston monica stupid 36 access coffee braves midnight shit 37 love xxxxxx yankee college saturn 38 buster bulldog lover baby gemini 39 1234567 ncc1701 barney cunt apples 40 soccer rabbit victor brian august 41 hockey peanut tucker mark 3333 42 killer john princess startrek canada 43 george johnny mercedes sierra blazer 44 sexy gandalf 5150 leather cumming 45 andrew spanky doggie 232323 hunting 46 charlie winter zzzzzz 4444 kitty 47 superman brandy gunner beavis rainbow 48 asshole compaq horney bigcock 112233 49 fuckyou carlos bubba happy arthur 50 dallas tennis 2112 sophie cream 51 jessica james fred ladies calvin 52 panties mike johnson naughty shaved 53 pepper brandon xxxxx giants surfer 54 1111 fender tits booty samson 55 austin anthony member blonde kelly 56 william blowme boobs fucked paul 57 daniel ferrari donald golden mine 58 golfer cookie bigdaddy 0 king 59 summer chicken bronco fire racing 60 heather maverick penis sandra 5555 61 hammer chicago voyager pookie eagle 62 yankees joseph rangers packers hentai 63 joshua diablo birdie einstein newyork 64 maggie sexsex trouble dolphins little 65 biteme hardcore white 0 redwings 66 enter 666666 topgun chevy smith 67 ashley willie bigtits winston sticky 68 thunder welcome bitches warrior cocacola 69 cowboy chris green sammy animal 70 silver panther super slut broncos 71 richard yamaha qazwsx 8675309 private 72 fucker justin magic zxcvbnm skippy 73 orange banana lakers nipples marvin 74 merlin driver rachel power blondes 75 michelle marine slayer victoria enjoy 76 corvette angels scott asdfgh girl 77 bigdog fishing 2222 vagina apollo 78 cheese david asdf toyota parker 79 matthew maddog video travis qwert 80 121212 hooters london hotdog time 81 patrick wilson 7777 paris sydney 82 martin butthead marlboro rock women 83 freedom dennis srinivas xxxx voodoo 84 ginger fucking internet extreme magnum 85 blowjob captain action redskins juice 86 nicole bigdick carter erotic abgrtyu 87 sparky chester jasper dirty 777777 88 yellow smokey monster ford dreams 89 camaro xavier teresa freddy maxwell 90 secret steven jeremy arsenal music 91 dick viking 11111111 access14 rush2112 92 falcon snoopy bill wolf russia 93 taylor blue crystal nipple scorpion 94 111111 eagles peter iloveyou rebecca 95 131313 winner pussies alex tester 96 123123 samantha cock florida mistress 97 bitch house beer eric phantom 98 hello miller rocket legend billy 99 scooter flower theman movie 6666 100 please jack oliver success albert ``` I don’t recall what the source of the list or the qualification for them being the worst was. ---
**Author:** ![fusoya](https://avatars.discourse-cdn.com/v4/letter/f/ecccb3/32.png) [@fusoya](https://boards.straightdope.com/u/fusoya)\ **Post date:** [April 13, 2010, 7:34pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/7 "2010-04-13T19:34:58Z")
[Here’s a list of the top 1000.](http://www.secure-computing.net/files/count_gt_1k.txt) It’s actually a pretty interesting read. Over 4000 people use batman as their password! ---
**Author:** ![tr0psn4j](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@tr0psn4j](https://boards.straightdope.com/u/tr0psn4j)\ **Post date:** [April 13, 2010, 7:34pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/8 "2010-04-13T19:34:59Z")
My doper password has one uppercase letter, two numbers, two symbols. All those things are scattered so it’s not like Weedsmoker!!69 😃 I have a few extra letters thrown in too. Initially I wanted to create a password with | and ` but it’s too hard to use them on a phone so I had to go with a slightly less cool password. ---
**Author:** ![kayaker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayaker/32/441_2.png) [@kayaker](https://boards.straightdope.com/u/kayaker)\ **Post date:** [April 13, 2010, 7:35pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/9 "2010-04-13T19:35:35Z")
> [@fusoya](#): > > Seriously folks, there’s no good reason not to have a strong password I don’t know. I need to input a password to get my voice-mail. Why should I worry about my voice-mail being secure? I use 1111 because I can punch it in without looking. ---
**Author:** ![Trepa\_Mayfield](https://avatars.discourse-cdn.com/v4/letter/t/edb3f5/32.png) [@Trepa\_Mayfield](https://boards.straightdope.com/u/Trepa_Mayfield)\ **Post date:** [April 13, 2010, 7:35pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/10 "2010-04-13T19:35:53Z")
My password is just \*\*\*\*\*\* Wait…no, it’s \*\*\*\*\*\* er… ---
**Author:** ![tr0psn4j](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@tr0psn4j](https://boards.straightdope.com/u/tr0psn4j)\ **Post date:** [April 13, 2010, 7:42pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/11 "2010-04-13T19:42:05Z")
> [@pedescribe](#): > > My password is just \*\*\*\*\*\* > > Wait…no, it’s \*\*\*\*\*\* > > er… There was a log of an IRC conversation I read that went something like that. “My password is \*\*\*\*” “Well mine is \*\*\*\*\*\*\*” “Wow that works?” “yes” “Cool! my password is 420the666kid69” People on the internet can be stupid. 🙂 Also, on #apprentice, one of the @s (Brimstone was his name I think) was notorious for typos. On multiple occassions he typed “j/oin #e-judge cabbage” into #apprentice which gave away the password to over 100 people. Those were some good times. ☹ ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [April 13, 2010, 7:46pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/12 "2010-04-13T19:46:17Z")
The importance of strong passwords is vastly overrated because it makes IT security people look like they’re doing something. You do need them – for anything to do with your personal finance or things like medical records. And it’s good to avoid the obvious ones. But if someone hacked into my New York Times login, they can _read the Times_ and it won’t be me! Disaster! As for e-mail, most scammers just phish for a password and use that. I don’t care how complex your password it – if you send it out to others, you’re going to get caught. There was an intriguing article on the subject in last week’s [Boston Sunday Globe.](http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/please_do_not_change_your_password/) ---
**Author:** ![AClockworkMelon](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aclockworkmelon/32/10803_2.png) [@AClockworkMelon](https://boards.straightdope.com/u/AClockworkMelon)\ **Post date:** [April 13, 2010, 8:12pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/13 "2010-04-13T20:12:11Z")
I have three core passwords, each with their own variants. They’re words with numbers and random capitalization mixed in. ---
**Author:** ![JRDelirious](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jrdelirious/32/9531_2.png) [@JRDelirious](https://boards.straightdope.com/u/JRDelirious)\ **Post date:** [April 13, 2010, 8:12pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/14 "2010-04-13T20:12:29Z")
> [@fusoya](#): > > So how strong is your doper password? Mine actually falls into the majority, with only lower case, 6 characters (but not a word in any language) the same password I use for most low-security login sites. Stuff that would cause real damage if it got breached, such as gmail and my bank account, get the upper/lower/number/! treatment. Very similar in my case. Lightweight sites/accounts get a variant on a simple basic set; really dangerous ones get a stronger protection. The long nonsense character string just doesn’t work well for me for mundane sites insofar as I have a horrible time remembering passwords; it has to have some sort of meaning or association in my mind. ---
**Author:** ![RTFirefly](https://avatars.discourse-cdn.com/v4/letter/r/c77e96/32.png) [@RTFirefly](https://boards.straightdope.com/u/RTFirefly)\ **Post date:** [April 13, 2010, 8:41pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/15 "2010-04-13T20:41:21Z")
I’ve got one password for all my ‘low-security’ accounts, i.e. those sites where logging in doesn’t enable me to buy anything or otherwise shell out $$ as a result of having provided that password. It’s a pretty simple password, if you’re me. If you’re not, you’re unlikely to guess it. But since I use that same short password at a whole bunch of sites, I’m not using it anywhere that a breach could cost me money. Here, the worst that could happen is that someone posts a lot of crap pretending to be me (I know: how would you know the difference? :)) and I might need to do some quick explaining to the admins if I wanted to remain a Doper. I use a set of varying passwords for sites like Amazon where I use the password to shell out money for stuff, and I change them periodically. ---
**Author:** ![Attack\_from\_the\_3rd\_dimension](https://avatars.discourse-cdn.com/v4/letter/a/b38774/32.png) [@Attack\_from\_the\_3rd\_dimension](https://boards.straightdope.com/u/Attack_from_the_3rd_dimension)\ **Post date:** [April 13, 2010, 9:03pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/16 "2010-04-13T21:03:49Z")
> [@tr0psn4j](#): > > My doper password has one uppercase letter, two numbers, two symbols. All those things are scattered so it’s not like Weedsmoker!!69 😃 > > I have a few extra letters thrown in too. > > Initially I wanted to create a password with | and ` but it’s too hard to use them on a phone so I had to go with a slightly less cool password. Your username is a better password than most passwords. ---
**Author:** ![tr0psn4j](https://avatars.discourse-cdn.com/v4/letter/t/958977/32.png) [@tr0psn4j](https://boards.straightdope.com/u/tr0psn4j)\ **Post date:** [April 13, 2010, 9:08pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/17 "2010-04-13T21:08:44Z")
> [@Attack\_from\_the\_3rd\_dimension](#): > > Your username is a better password than most passwords. The running theory from the SDMB Left 4 Dead 2 crew is I accidentally typed my password in the username field. They’re wrong though. 😃 ---
**Author:** ![Bootis](https://avatars.discourse-cdn.com/v4/letter/b/e8c25b/32.png) [@Bootis](https://boards.straightdope.com/u/Bootis)\ **Post date:** [April 13, 2010, 9:18pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/18 "2010-04-13T21:18:43Z")
> [@KneadToKnow](#): > > Also, from an older source (Mark Burnett’s 2005 book “Perfect Passwords: Selection, Protection, Authentication,”) here’s a table of the “Top 500 Worst Passwords Of All Time”: Anyone with a clue why “abgrtyu” would be one of the 500 worst passwords? ---
**Author:** ![maplekiwi](https://avatars.discourse-cdn.com/v4/letter/m/a4c791/32.png) [@maplekiwi](https://boards.straightdope.com/u/maplekiwi)\ **Post date:** [April 13, 2010, 9:23pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/19 "2010-04-13T21:23:25Z")
I’ve used abc123 in the past. :smack: & my first workplace password was my daughter’s name :smack: :smack: I know your not meant to but I now have a hardcover exercise book & I write my passwords down. I’m sick of losing & forgetting them. ---
**Author:** ![bup](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@bup](https://boards.straightdope.com/u/bup)\ **Post date:** [April 13, 2010, 9:25pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/20 "2010-04-13T21:25:43Z")
I’m surprised there’s not more ‘godiwantthatwomaninfinancials’ type stuff in there. [Next page](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977.md?page=2)