The cybersecurity portal Cybernews has analyzed more than 19 billion stolen passwords since April 2024. The result is alarming: only six percent of the stolen passwords were truly unique. The rest were a feast for automated attacks.
The analysis shows that 42 percent of all users use passwords with eight to ten characters. This corresponds to the minimum length required by many platforms. However, only very few of these consist of a combination of special characters or more complex combinations. As a result, brute force attacks - i.e. the systematic testing of passwords by hackers - remain frighteningly efficient.
"1234" rules the darknet
Despite decades of research, absurdly simple passwords continue to dominate the ranking of the worst logins. In first place: "1234" - found in over 727 million cases. Followed by "123456" (338 million), "password" (56 million) and the all-purpose word "admin" (53 million).
These passwords are not barriers for hackers, but invitations. They can be cracked within seconds using the simplest of means - even by less experienced attackers.
There has always been some progress. Compared to 2022, the proportion of complex passwords - i.e. those with upper and lower case letters, numbers and symbols - has increased from one to 19 percent.
Long and simple or short and complex
But how can a good password be created without any cryptographic knowledge or memory acrobatics? As a rule, two approaches are sufficient. Either long and simple. In other words, passwords with more than 25 characters, made up of several easy-to-remember words (e.g. WaldSchokoladeHimmelRegen). Or short and complex: at least twelve characters, consisting of upper and lower case letters, numbers and special characters.
The use of password managers is also recommended for everyday use. They create strong combinations, memorize them and reduce the temptation to use the same password multiple times.