Most common passwords of 2026: 123456 leads stealer logs again

The most common password stolen by infostealer malware in 2026 is 123456, captured 612,110 times so far this year, followed by 12345678 (268,742), 1234 (161,322), admin (157,849) and 123456789 (152,494). It is the third year in a row that 123456 has led the list, after 851,369 captures in 2024 and 1,612,518 in 2025. It is also the password that, by the attacker’s own account, opened Denmark’s population register in September. The ranking comes from the 200 most frequent password values recorded each year in the Alerts.bar infostealer index, which Ransomnews licenses and has cleaned of parser noise. The ranking itself is the least interesting part. Administrator passwords are climbing, and the passwords that corporate complexity rules produce, Pass@123, Admin@123, Welcome@123, have more than doubled their share since 2024.

In brief

• 123456 is the most common password in infostealer logs for the third consecutive year: 612,110 captures in 2026 to date, a fifth of all captures in the top 100.
• Six of the top ten are digit strings; the other four are admin, password, Aa123456 and admin123. Digit-only passwords make up 67 per cent of the top-100 volume in 2026, down a little from 71 per cent in 2024.
• The admin family (admin, admin123, Admin@123, admin@123 and six variants) was captured 291,149 times in 2026. admin123 climbed from 19th place in 2024 to 10th, and Admin@123 from 25th to 19th.
• The @123 family, the shape produced by “one capital, one symbol, one number” rules, more than doubled, from 3.6 per cent of the top-100 volume in 2024 to 7.8 per cent in 2026. Test@123 rose from 104th to 42nd, Welcome@123 from 78th to 37th.
• Keyboard walks are falling: qwerty slipped from 39th to 49th and qwertyuiop from 40th to 58th.
• Parser artefacts, the empty, “not saved” and “decryption failed” strings that stealers write when they cannot read a browser’s password store, grew from 43 per cent of the raw top-200 volume in 2024 to 70 per cent in 2026.
• The list is in use. The person who accessed 8.8 million Danish CPR records in September says a Pays ApS account protected by 123456 was the way in, and in 2025 the same string opened an administrator test account on McDonald’s recruiting platform McHire.
• Infostealers do not crack passwords. They copy what the browser already saved, so every password on this list was a working login on an infected device.

The 100 most common passwords of 2026

The table lists the 100 most frequent password values in the 2026 data with their capture counts; the comparison with 2024 and 2025 follows it. A capture is one saved credential recorded in a stealer log; the same password saved for ten sites on one infected device counts ten times, which is also how the buyer of the log sees it.

#	Password	Captures, 2026 to date
1	123456	612,110
2	12345678	268,742
3	1234	161,322
4	admin	157,849
5	123456789	152,494
6	12345	107,329
7	123	92,214
8	password	86,943
9	Aa123456	75,621
10	admin123	53,012
11	Pass@123	50,320
12	111111	44,535
13	1234567890	40,923
14	123123	38,793
15	01	37,692
16	12345678910	36,473
17	000000	33,472
18	1234567	31,825
19	Admin@123	30,793
20	112233	24,710
21	P@ssw0rd	21,716
22	1111	20,904
23	0000	20,208
24	Aa@123456	19,522
25	abc123	15,581
26	Password@123	15,554
27	654321	14,553
28	Abcd@1234	14,415
29	Password	14,194
30	12341234	14,159
31	abcd1234	14,097
32	root	13,899
33	admin@123	13,630
34	102030	13,089
35	asd123	13,055
36	Pass@1234	13,010
37	Welcome@123	12,648
38	password123	12,415
39	11223344	11,708
40	0987654321	11,552
41	11111111	10,856
42	Test@123	10,715
43	87654321	10,646
44	00000000	10,566
45	guru123456	9,936
46	qwerty123	9,818
47	Aa123456@	9,793
48	123123123	9,734
49	qwerty	9,701
50	Aa@1234567	9,531
51	987654321	9,270
52	1q2w3e4r	8,718
53	Kumar@123	8,650
54	asdf1234	8,504
55	Nn123123	8,450
56	Abcd1234	8,280
57	Admin123	8,192
58	qwertyuiop	8,087
59	Abcd@123	8,085
60	aa123456	8,083
61	123456789.	7,610
62	123321	7,486
63	121212	7,476
64	2580	7,457
65	India@123	7,369
66	Aa112233	7,350
67	Rahul@123	7,188
68	Password1	7,036
69	1122	7,009
70	Abc@1234	6,949
71	Pakistan@123	6,856
72	test	6,752
73	qwer1234	6,667
74	pass	6,610
75	demo	6,558
76	admin1234	6,478
77	masuk123	6,455
78	Admin@1234	6,438
79	1122334455	6,308
80	2020	6,232
81	welcome@123	6,103
82	123qwe	6,044
83	Qwerty123	5,988
84	qwe123	5,936
85	10203040	5,841
86	Admin	5,682
87	88888888	5,642
88	0123456789	5,618
89	888888	5,573
90	Password123	5,542
91	666666	5,492
92	12345678a	5,439
93	1234qwer	5,409
94	1qaz2wsx	5,361
95	Digital@123	5,184
96	1q2w3e4r5t	5,169
97	Welcome1	5,151
98	1212	5,132
99	eraporkm123456	5,000
100	123456789a	4,979

Set against the two previous years, the top ten is almost static. The table shows the ten most common passwords in each year with their capture counts. The 2026 column covers the year to date, so compare positions rather than volumes.

#	2024	2025	2026 to date
1	123456 (851,369)	123456 (1,612,518)	123456 (612,110)
2	12345678 (336,871)	12345678 (651,684)	12345678 (268,742)
3	admin (269,525)	admin (429,497)	1234 (161,322)
4	123456789 (248,365)	123456789 (425,527)	admin (157,849)
5	1234 (213,355)	1234 (407,298)	123456789 (152,494)
6	12345 (156,532)	12345 (298,161)	12345 (107,329)
7	123 (123,460)	123 (237,349)	123 (92,214)
8	Aa123456 (96,913)	Aa123456 (191,408)	password (86,943)
9	password (87,768)	password (184,463)	Aa123456 (75,621)
10	01 (64,709)	01 (108,756)	admin123 (53,012)

The top of the list has barely moved in three years. The first nine entries in 2026 are the same nine as in 2024 and 2025, in almost the same order; 1234 rose from fifth to third and admin slipped one place to fourth. Aa123456, one capital, one lower-case letter and six digits, the minimum that satisfies most complexity rules, has sat at eighth or ninth every year. The movement is below the top ten.

Admin and policy-shaped passwords are rising, keyboard walks are falling

The biggest climbers in the 2026 top 50 against their 2024 rank are Test@123 (104th to 42nd), Welcome@123 (78th to 37th), Pass@1234 (75th to 36th), Password@123 (57th to 26th), Abcd@1234 (51st to 28th), admin@123 (48th to 33rd) and admin123 (19th to 10th). The biggest fallers are qwertyuiop (40th to 58th), 987654321 (35th to 51st), 123123123 (34th to 48th), qwerty (39th to 49th) and 1q2w3e4r (42nd to 52nd). The share of the top-100 volume made up of digit-only strings eased from 71 per cent to 67 per cent over the three years, the admin family held at around 10 per cent, and the @123 family went from 3.6 to 7.8 per cent.

The absolute numbers moved too. The 2025 file is the largest of the three: 123456 alone was captured 1,612,518 times, nearly double the 2024 figure, and the cleaned top 200 for 2025 holds 7.7 million captures against 4.0 million in 2024. The 2026 figures cover the year to date and are not yet comparable in volume, so the ranks, not the counts, are the right basis for year-on-year claims.

Where 123456 got someone in

On 5 October 2026 the Danish government confirmed that data on 8.8 million people in the CPR population register had been accessed through Pays ApS, an IT firm with authorised lookup rights. The person claiming the intrusion told Politiken that the way in was a Pays account protected by 123456, and Politiken reported that at least three company accounts, one of them an administrator account, used that password. Access began on 10 September, about 14 million automated lookups followed until 20 September, and the intrusion was found on 2 October when a ministry employee noticed an unusually large invoice. Pays and the government have not confirmed the password claim, and the claimant says the data will not be sold or leaked. If the account holds up, what Ingeniøren called the largest personal data leak in Danish history came down to the first line of the table above.

The precedent is McHire, the McDonald’s recruiting platform run by Paradox.ai. In July 2025 researchers Ian Carroll and Sam Curry logged into a Paradox staff test account with 123456 as both username and password, received administrator access, and found applicant IDs running past 64 million, each one a chat transcript that could hold a name, email address, phone number and home address. Paradox said the account had not been used since 2019 and should have been decommissioned, and fixed the flaw within two days. KrebsOnSecurity then found the other half of the story inside the same company: a Paradox developer’s personal device had been infected with Nexus Stealer at the end of June 2025, and the log held hundreds of weak, recycled passwords, among them administrator credentials for the company’s Okta single sign-on. One was a password nobody changed, the other a password a stealer copied, and the 612,110 copies of 123456 in this year’s logs are where the next case comes from.

Admin passwords are what ransomware affiliates buy

Administrator passwords are the part of this list with a resale price. A stealer log that contains admin or Admin@123 saved against a router, a firewall, a web console or a VPN portal is an initial-access listing waiting to happen, and the access-broker market prices it accordingly. The leaked internal chats of The Gentlemen, the most prolific ransomware operator of the past six months, showed a crew that bought logs by the batch, worked credential lists against Fortinet and Cisco edge devices, and treated purchased access as the normal way in, as we set out in our analysis of the group after the leak. In the 2026 data the admin family alone accounts for 291,149 captures across ten spellings, and two of its members are rising faster than almost anything else on the list. Each of those captures is a device whose administrator credential was saved in a browser on a machine that was later infected.

The same logs explain why a weak password on a consumer account becomes a corporate problem. An employee who saves a work VPN login in the same browser profile as a 123456 gaming account hands both to the stealer in the same capture. Organisations can see their own exposure in aggregate, without any credentials being displayed, through Stealercheck, which queries the same index this report is built on.

Complexity rules are writing the passwords

A growing share of the list is written by the policy rather than the user. Pass@123, Admin@123, Password@123, Welcome@123, Test@123, Abcd@1234 and their relatives all satisfy a rule that demands an upper-case letter, a lower-case letter, a digit and a symbol, and all are among the most common passwords in the world. The family grew from 13 strings and 153,053 captures in the cleaned 2024 top 200 to 22 strings and 245,533 captures in the 2026 data, and its share of the top-100 volume more than doubled. Aa123456 and its variants, which meet the same rule with the least possible effort, add another 4 to 5 per cent each year. This is the pattern that NIST’s revised digital identity guidance, SP 800-63B revision 4 of August 2025, was written to end: it bars composition rules outright, sets a minimum of 15 characters where a password is the only factor, drops routine expiry and makes screening against blocklists of known-compromised passwords mandatory. Every entry in the table above is on those blocklists, and every one of them was in use on an infected device this year.

Stealers are hitting password stores they cannot read

More of what stealers pull out of browsers now comes back unreadable. Before cleaning, the top-200 file for each year is dominated by strings that are not passwords at all: empty values, [NOT_SAVED], *none*, masked values and the error messages that stealer parsers write when a browser’s credential store will not decrypt, such as “Decryption failed”, “Old or unknown version” and “Key not found for version”. Those artefacts were 43 per cent of the raw top-200 volume in 2024, 57 per cent in 2025 and 70 per cent in 2026, and the decryption-failure messages specifically grew from 0.5 per cent to 9 per cent. The timing matches Google’s introduction of app-bound encryption for Chrome on Windows in July 2024, which Microsoft Edge adopted at the same time and which the stealer ecosystem has spent two years working around, with mixed success. The caveat is that the mix of stealer families in the index changes from year to year, and each family writes its own placeholder strings, so the artefact share is a signal rather than a measurement. The direction is clear enough: a growing proportion of what stealers exfiltrate from password stores is unusable to the buyer.

How this list was built

The source is the Alerts.bar index of credentials recovered from infostealer logs, which Ransomnews licenses and which also powers Stealercheck. Alerts.bar is an independent provider. For each of 2024, 2025 and 2026 to date we took the 200 most frequent password values with their capture counts; nothing here comes from breach dumps, combolists or password-cracking, only from what stealer malware copied out of infected devices. We then removed three kinds of noise. First, parser artefacts: empty strings, placeholders such as [NOT_SAVED] and *none*, masked values and decryption error messages, which are reported above as a finding in their own right. Second, single-character values such as 0, 1 and a, which are keystrokes or placeholders rather than passwords, together with one name-and-number string that recurred across years. Third, single-source strings: 39 values in 2026, 9 in 2025 and 15 in 2024 that appear in only one year, do not match any generic pattern and in most cases contain a name, a company or a date, which marks them as one person’s or one organisation’s password duplicated across many logs. Publishing those would be publishing credentials, so they are excluded and counted only in aggregate; they total 323,942 captures in 2026. Everything that remains is either a recognisable pattern or appears in at least two of the three years. We have not deduplicated logs that were sold or re-packaged more than once, because the index does not expose that, and we do not have the total number of credential records per year, so this report states counts and ranks, not percentages of all captured passwords.

The browser is the target, not the password

The passwords on this list are weak, but correct-horse-battery-staple would have been stolen just as easily from the same infected device; stealers copy, they do not guess. For individuals the controls that help are a password manager with unique passwords per site, which limits one infection to one account at a time; passkeys or hardware-backed multi-factor authentication wherever they are offered, because a stolen password is then not enough; and not saving work logins in a personal browser profile. For organisations the order is the one NIST now prescribes: screen every new password against a compromised-password blocklist, drop composition rules and forced rotation, require length instead, and move administrator and remote-access accounts to phishing-resistant authentication. Then monitor for your own domain in stealer logs, because the first sign of a compromised employee device is usually a credential turning up for sale; our review of Alerts.bar covers one way to do that, and stealer logs explained covers what a log contains and how it is traded.

Suggested citation: Ransomnews Research Team, “Most common passwords of 2026: 123456 leads stealer logs again”, Ransomnews, October 2026, from Alerts.bar infostealer index data. The infostealer statistics page carries the monthly exposure snapshots that complement this list.

Frequently asked questions

Sources and further reading

• Alerts.bar infostealer index, the 200 most frequent password values for 2024, 2025 and 2026 to date, as supplied to Ransomnews under licence
• The Register, ‘123456’ password linked to Denmark data breach affecting 8.8M people (13 October 2026); Ingeniøren, Millioner af CPR-numre var beskyttet med adgangskoden 123456 (9 October 2026, citing Politiken)
• KrebsOnSecurity, Poor passwords tattle on AI hiring bot maker Paradox.ai (17 July 2025); Paradox.ai, statement on the white-hat researcher report
• NIST, SP 800-63B revision 4, Digital identity guidelines: authentication and authenticator management (August 2025)
• Google Security Blog, Improving the security of Chrome cookies on Windows (30 July 2024)
• ElcomSoft, Browser forensics in 2026: app-bound encryption and live triage (13 January 2026)
• Related: stealer logs explained, infostealer statistics, Stealercheck, and initial access brokers and the 2026 ransomware supply chain

Reporting by the Ransomnews Research Team. Counts are aggregate frequencies from the Alerts.bar index, an independent provider whose data Ransomnews licenses. No credential is linked to any person, account or organisation, and strings that could identify one have been removed from the published data.