Analysis of 6 Billion Passwords Shows Stagnant User Behavior

An analysis of 6 billion credentials leaked in 2025 confirms that poor password hygiene persists, with simple numeric sequences and common words still dominating user choices, according to Specops Software. The five most common compromised passwords were ‘123456’, ‘123456789’, ‘12345678’, ‘admin’, and ‘password’, and the study notes little change in behaviour over many years.

While some passwords are marginally more complex, they still rely on predictable base terms such as ‘admin’, ‘guest’, ‘qwerty’, ‘secret’, ‘Welcome’, ‘student’, ‘hello’, and ‘password’, and the report highlights regional and language-linked patterns like ‘Pakistan123’ and ‘hola1234’.

It warns that malware-driven credential theft can enable reuse across Active Directory, VPN, or cloud identities, granting attackers trusted access to corporate systems, particularly where default credentials are used for networking equipment, IoT devices, and ICS.

The security firm recommends a layered defence, including continuous monitoring of compromised credentials, blocking predictable patterns at creation, and enforcing phishing-resistant MFA across high-risk paths and recovery workflows, based on its findings. According to Specops Software.