📊 Why the “Most Common Passwords” Lists Disagree

The contradiction, stated plainly

Every winter a wave of headlines announces the year’s most common passwords. They agree on the punchline — 123456 wins, again — and they quietly disagree on almost everything underneath it. Ask a simple question, “how many people used 123456 last year,” and the published answers scatter across two orders of magnitude:

• NordPass: 123456 appeared just over 3 million times in the 2.5TB corpus they analyzed.
• Comparitech: the same string appeared 7.6 million times across the ~2 billion passwords they gathered from breach forums.
• Cybernews: in their 19-billion-password study, 123456 turns up in roughly 338 million cases.

None of these numbers is wrong. They are answers to different questions that happen to share a sentence. Once you see what each study actually sampled, the contradiction dissolves — and, more usefully, you learn which list to reach for depending on what you’re trying to decide. That is what this page is for: not another ranking, but the reconciliation nobody publishes alongside the rankings.

Four studies, four populations

There is no register of “all passwords in use.” Every list is a sample of leaked credentials, and the leak channel determines the sample. Here are the four that drive the headlines, by what they actually measure.

1. NordPass — a curated breach-and-dark-web corpus

NordPass’s Top 200 Most Common Passwords is now in its seventh annual edition, produced with the threat-intelligence firm NordStellar and independent incident researchers. The stated method: analyze recent public data breaches and dark-web repositories from a fixed window — September 2024 to September 2025 for the latest edition — organize the results by country across 44 nations, and this year map habits by generation using available metadata. Their headline number is derived from a 2.5TB database extracted from publicly available sources including the dark web, with no personal data purchased.

The important caveat is one NordPass does not resolve: it does not specify whether the sample is its own user base or a broader population, and it does not publish the corpus composition or deduplication rules. That makes the ranking directional but not reproducible — you cannot re-run it — and it is a large part of why NordPass’s absolute counts sit far below aggregators that ingest more dumps. A telling internal signal: in NordPass’s own data the global #1 is 123456, but “admin” tops the list in some countries such as Canada, and admin ranks #1 in the United States — a reminder that even one study fractures by sub-population.

2. Have I Been Pwned — hash prevalence, not a ranking

HIBP is the odd one out, and the most rigorous. Troy Hunt’s Pwned Passwords service does not publish a “top 200” at all; it stores the prevalence count of every password hash it has ever ingested and lets you query a single password to see how many times it has appeared in known breaches. Crucially, passwords are stored separately from email addresses, with no association between them, so checking a standalone password reveals nothing about whose it was.

The query itself is privacy-preserving by design. Under k-anonymity, your client computes the SHA-1 hash of the password, sends only the first five characters of that hash to the API, and receives every matching suffix; the comparison finishes on your device, so the operator never sees the password or even enough of the hash to identify it. It is heavily used precisely because it is trustworthy — HIBP has served over 17 billion Pwned Passwords requests in a single 30-day period.

Because HIBP aggregates continuously rather than in an annual snapshot, its corpus is the broadest of the four. Late 2025 alone added the Synthient Credential Stuffing dataset of ~2 billion email addresses and 1.3 billion passwords, 625 million of them never previously seen by HIBP, followed by a 630-million-password corpus from an FBI device seizure. HIBP does not tell you the internet’s favorite password; it tells you, authoritatively, whether yours is burned.

3. Specops — malware-stolen credentials and live attacks

Specops’ 2026 Breached Password Report analyzes more than 6 billion malware-stolen passwords captured during 2025 by the threat-intelligence team at parent company Outpost24 — roughly six times the 1.09 billion in the prior edition, reflecting how fast infostealer operations have scaled. It is fed by two channels no other list on this page emphasizes: infostealer logs and a global honeypot network that records passwords used in live attacks against Windows-like endpoints.

That collection method produces the single most important finding in the whole subject, and it is one the guessing-oriented lists structurally cannot see. Specops reports on the order of 230 million compromised passwords that satisfied standard complexity requirements — length, mixed case, symbols — and were stolen anyway. The mechanism is simple and uncomfortable: complexity rules defend against guessing, and an infostealer does not guess. It reads the credential in cleartext from the browser after you type it. A 16-character passphrase and 123456 are captured identically. Specops’ own summary is blunt — static password controls don’t reflect how credentials are actually stolen, reused, and operationalized today.

4. Cybernews & Comparitech — large public-dump compilations

These two occupy the middle ground: very large, breach-sourced, and reasonably transparent about scope, but shaped by which dumps they happened to gather. Cybernews’ 2025 study examined more than 200 breaches between April 2024 and April 2025, totaling 19,030,305,929 passwords, of which only 6% were unique — the widely-quoted “94% reused” figure. Comparitech built a separate list from over two billion real passwords leaked on breach forums in 2025. Their scale sits between NordPass’s curated corpus and HIBP’s continuous aggregation, which is exactly why their 123456 counts land between the two as well.

Side by side

The disagreement is entirely predictable once the methodologies are laid out together. What each study is really reporting:

Three forces explain essentially all of the numeric spread. Corpus size: a study that ingests 19 billion rows will report bigger absolute counts than one analyzing a few million, for the same password. Deduplication: counting every occurrence versus counting unique (password) or unique (email, password) pairs changes totals dramatically — and most lists don’t state which they did. Collection channel: breach dumps skew toward old and sometimes-hashed credentials; stealer logs skew toward currently-active, plaintext, in-use ones. Different channel, different password mix.

The one number they actually agree on

Strip out the absolute counts and a strong consensus appears in the ordering. Across every methodology on this page, the same handful of passwords dominates the top: Specops’ malware-captured corpus ranks 123456, admin, and password at the top, mirroring NordPass’s order, and Comparitech’s forum-sourced list leads with the same strings. The rank order is remarkably stable — 123456 has topped NordPass in six of the seven years the list has run — even as the counts swing by 100×.

That split is the real lesson. Relative ranking is robust; absolute frequency is an artifact of the corpus. So a claim like “123456 is the most common password” is well-supported. A claim like “123456 was used X million times last year” is only true within one study’s sample and should never be quoted as a fact about the whole internet — which is precisely how it usually gets quoted.

Check it yourself (a reproducible method)

You don’t have to trust any single ranking. HIBP’s k-anonymity API returns a real prevalence count for any password, free and without a key, and the method is fully reproducible — anyone can re-run it and get the same answer, which is exactly what the annual lists cannot offer. To check a candidate password against the largest aggregated corpus:

1. Compute the SHA-1 hash of the password and uppercase it.
2. Send the first 5 hex characters to https://api.pwnedpasswords.com/range/<prefix>.
3. The API returns every hash suffix seen in breaches, each with its prevalence count.
4. Look for your hash’s remaining 35 characters in the response. The number beside it is how many times that exact password has appeared across HIBP’s breaches. Absent = not yet seen (which is not the same as safe).

Our Pwned Password checker runs exactly this flow in your browser, so the password never leaves your device. Because HIBP ingests more breaches than any annual study samples, its count is the closest thing to an authoritative “how burned is this string” figure — and unlike a ranking, you can verify it against the live API yourself.

Protecting yourself — and why the endpoint is now the weak point

The reconciliation points to a defense that has shifted over the last two years. When breach dumps drove the numbers, the advice was entirely about the password: make it long, make it unique, check it against HIBP. All still true. But the fastest-growing corpus — Specops’ malware-stolen data — is captured on infected devices, where passwords that satisfy enterprise policies are stolen directly from compromised endpoints. Against that channel, password strength contributes nothing, because the theft happens after authentication, at the keyboard.

So the current shortlist is: use a unique password per account via a manager; turn on MFA everywhere and prefer phishing-resistant passkeys where offered, since they remove the reusable shared secret entirely; check important passwords against Pwned Passwords; and — the newer entry — keep the device itself clean, because a machine running an infostealer leaks even a perfect password. Real-time endpoint protection is what closes that last gap; a maintained suite such as Bitdefender affiliate, or the built-in Microsoft Defender that we earn nothing from, guards the endpoint where the credential is typed. Entropy math and honeypot telemetry now point at the same conclusion from opposite ends: the password is necessary, and no longer sufficient.

Bottom line

The lists don’t contradict each other so much as talk past each other. Each samples a different slice of the same leaking ecosystem, so their rankings agree and their counts don’t. When you next see “the most common password was used N million times,” the right question is which corpus — and the right list depends on your question: a large compilation for what people set, Have I Been Pwned for whether your own password is compromised, and Specops for what attackers are throwing at systems today.

Primary sources: NordPass / NordStellar Top 200 Most Common Passwords; Troy Hunt / Have I Been Pwned (Pwned Passwords, Synthient & FBI corpus write-ups); Specops Software / Outpost24 2026 Breached Password Report and live-attack data; Cybernews 2025 password-leak study; Comparitech 2025 most-common-passwords analysis. Figures reflect each study’s stated methodology; absolute counts are corpus-specific by design.