New research has uncovered the passwords most commonly found in leaked data, revealing the choices people should avoid using online.
Insurance experts at Alan Boswell Group analyzed password data from Have I Been Pwned, which contains hundreds of millions of passwords exposed in data breaches, to identify the most common password choices used online.
From names, years and number combinations to sports, football teams, famous figures, fictional characters, animals, plants and everyday objects, these are the passwords people should avoid using.
The most-used passwords overall
Despite repeated warnings against using simple number combinations, ‘123456’ remains the most common password in the analysis, appearing 209,972,844 times.
‘123456789’ is the second most common, appearing 80,942,123 times, followed by ‘12345678’, which appears 70,382,347 times.
The most-used names in passwords
The name ‘Daniel’ is the most commonly used name in passwords, appearing as an exact password 2,533,375 times.
‘Michael’ follows in second, appearing 2,332,388 times, while ‘Jessica’ ranks third, appearing 1,893,068 times.
Other names including Thomas, Ashley, Anthony, Michelle and Nicole also appear among the most common password choices.
The most-used years in passwords
When it comes to years, 2020 is the most commonly used, appearing as an exact password 1,441,965 times.
The year 1990 is second, appearing 712,954 times, while 2021 follows in third, appearing 659,470 times.
Years like 1990, 1994 and 1989 may point to people using birth years or important dates, while more recent years such as 2020, 2021 and 2022 could reflect passwords created for newer accounts, where users simply added the current year to make a password meet security requirements.
The most-used sports teams in passwords
The top five soccer teams used in passwords are Liverpool, Barcelona, Juventus, Chelsea and Arsenal.
Liverpool is the most commonly used team, appearing as an exact password 1,789,470 times, followed by Barcelona, which appears 1,285,484 times.
NFL teams also appear in the top 10, with Pittsburgh Steelers ranking seventh at 503,219 uses, followed by Philadelphia Eagles in ninth with 474,904 and Dallas Cowboys in 10th with 418,439.
Among sports, ‘football’, ‘baseball’ and ‘soccer’ are the top three most popular sports used in passwords.
‘Football’ appears 2,603,807 times, while ‘baseball’ appears 1,937,815 times and ‘soccer’ appears 1,769,491 times.
The most-used famous names and pop culture references in passwords
‘Blink-182’ is the most commonly used pop culture reference as a password, appearing 1,654,660 times.
Metallica follows closely behind, appearing 1,128,022 times. Other common pop culture references include Eminem, Ronaldo, Nirvana and 50 Cent.
The most-used fictional characters in passwords
Among fictional characters, ‘Superman’ is the most common password choice, appearing 2,134,813 times.
‘Naruto’ follows in second, appearing 1,643,637 times, while ‘Batman’ ranks third, appearing 1,338,840 times.
The most-used animals in passwords
Animal-related passwords are also common, with ‘monkey’ appearing as an exact password 3,963,423 times.
‘Butterfly’ follows in second, appearing 1,176,152 times, while ‘chicken’ appears 917,838 times.
The most-used plants in passwords
Among plants, fruits and vegetables, ‘orange’ is the most common password choice, appearing 1,127,398 times.
‘Banana’ follows in second, appearing 1,122,955 times, while ‘flower’ ranks third, appearing 1,102,190 times.
The most-used objects in passwords
Among everyday objects, ‘computer’ is the most common password choice, appearing 2,422,759 times.
‘Diamond’ follows in second, appearing 1,001,879 times, while ‘silver’ ranks third, appearing 881,203 times.
Heath Alexander-Bew, personal lines director at Alan Boswell Group, commented on the findings: Weak passwords can feel like a small issue, but they can cause problems very quickly, whether it is a personal email account or a workplace system. For individuals, it could mean someone accessing shopping accounts, banking apps or social media. For a business, it could open the door to invoices, customer details, internal files or password reset links for other platforms.
What is worrying about these passwords is that many of them are not really being guessed. They are already sitting in leaked password lists, and criminals can use automated tools to try them across different sites. That is why passwords like ‘123456’, ‘admin’, a football team, a name or a birth year can still be risky, especially when people reuse them across work and personal accounts.
The financial side of this should not be ignored either. The FBI’s latest Internet Crime Report found that suspected internet crime losses exceeded $16 billion in 2024, up 33% from the year before. For businesses, the cost of a breach can be even more severe; IBM’s 2025 Cost of a Data Breach Report found that the average cost of a data breach in the US reached a record $10.22 million. That is why weak passwords are not just a personal inconvenience. They can become a serious business risk very quickly.
The safest approach is to stop relying on passwords that feel easy to remember. Businesses should block the most common leaked passwords, use multi-factor authentication and encourage staff to use password managers. Individuals should do the same for their personal accounts, especially email, banking and shopping logins. It is also worth checking recovery details and forwarding rules after changing a password, because if someone has already been inside an account, changing the password alone may not fully solve the problem.
