It is not just the words in a password. It is how they are used, how predictable they are, whether they have been exposed online, and whether attackers already include them in password spraying and password cracking dictionaries.
Originally published as “Top 15 Worst Passwords,” this list has been updated for 2026 to reflect modern password attack trends, compromised credential exposure, and common password spraying patterns.
This list is not meant to be a universal ranking of the most-used passwords worldwide. Instead, it highlights high-risk passwords and password patterns that commonly appear in breach datasets, password spraying attempts, password cracking dictionaries, default-password workflows, and enterprise identity environments.
Even today, weak and compromised passwords continue to play a major role in account takeover, credential stuffing, and Active Directory attacks. According to the Verizon Data Breach Investigations Report (DBIR), compromised credentials as an initial access vector in 22% of reviewed breaches, and is the top initial breach vector.
Modern attackers rarely “hack” passwords manually. Instead, they rely on automation, using massive password dictionaries filled with commonly used passwords, predictable password patterns, leaked credentials, keyboard combinations, company references, and previously exposed passwords collected from breaches and infostealer malware.
For organizations using Active Directory and hybrid identity environments, these password patterns continue to create unnecessary risk.
Weak passwords are no longer just a consumer problem.
Modern identity attacks increasingly rely on password spraying, credential stuffing, and valid account abuse using passwords attackers already possess. Instead of targeting a single account repeatedly, attackers often attempt commonly used passwords across many accounts at once to avoid lockouts and detection.
Infostealer malware has also dramatically increased the amount of exposed credential data available to cybercriminals. In many cases, attackers are not guessing passwords at all. They are using credentials already stolen from infected devices, browser password stores, third-party breaches, or underground marketplaces.
For enterprise environments, this becomes especially dangerous because one compromised password can provide access to VPNs, SaaS applications, email systems, cloud environments, and Active Directory infrastructure, especially when employees reuse passwords across personal and work accounts.
This is one reason why organizations increasingly focus on compromised password screening and continuous password monitoring rather than relying only on password complexity requirements.
A password may appear strong based on traditional complexity rules and still be unsafe.
For years, organizations focused heavily on password requirements involving uppercase characters, lowercase characters, numbers, symbols, and periodic password changes. While complexity still matters, many attackers now target passwords that already exist in breach datasets or password cracking dictionaries.
For example, Password!2026 may technically satisfy many password policies, but it still follows highly predictable patterns commonly used in password spraying attacks.
This is one reason modern password guidance has shifted toward identifying weak, predictable, reused, and compromised passwords rather than relying only on complexity rules alone.
NIST SP 800-63B Digital Identity Guidelines recommends screening passwords against known compromised password lists and blocking common or predictable passwords. NIST also recommends avoiding unnecessary password expiration policies unless compromise is suspected.
As identity attacks continue evolving, organizations increasingly recognize that a “complex” password is not necessarily a safe password if attackers already know it.
A strong password isn’t necessarily a safe password.
Although many passwords meet traditional complexity requirements, they may still be unsafe if they already exist in password cracking dictionaries, breach datasets, or exposed credential lists used by cybercriminals.
Using unique passwords for every account remains one of the most important steps users can take to reduce risk. Reusing passwords across websites dramatically increases exposure because a breach affecting one site can quickly lead to credential stuffing attacks against banking accounts, email platforms, streaming services, corporate logins, and other online systems.
Users should also avoid predictable password patterns tied to seasons, years, sports teams, family names, birthdays, or company references. Attackers actively target these patterns because they continue to be widely used.
Longer passphrases combined with unique passwords and multi-factor authentication provide significantly stronger protection than short, predictable passwords rotated every few months.
You can see if a sample password is generally safe, weak, or compromised here.
Don’t let employees use weak or compromised passwords.
Many organizations still rely primarily on traditional password complexity requirements while allowing passwords that are predictable, reused, or already exposed online. Unfortunately, these passwords remain highly vulnerable to modern credential attacks.
For Active Directory environments, predictable password patterns often emerge around onboarding workflows, help desk resets, company naming conventions, seasonal password rotations, and default passwords. Attackers specifically build password spraying dictionaries around these common enterprise behaviors.
Organizations increasingly need the ability to identify and block:
Modern password security strategies increasingly include compromised password screening, continuous password monitoring, banned password lists, password similarity blocking, and Active Directory password protection controls.
With automated weak password filtering, fuzzy password matching, password similarity blocking, and custom password dictionary filtering, enterprises can better align with NIST password guidance while reducing exposure to credential-based attacks.
To see how it can work, review this solution brief from Cybersecurity Insiders.