18 Common Passwords Hackers Can Guess in Under 5 Seconds—Is Yours One of Them?

These days, protecting your online accounts is more important than ever. But many people still use passwords that are way too easy to guess—like something out of a bad movie plot. An experienced hacker can crack your password faster than you can say "cybersecurity." Scary, right?

To stay safe, avoid these passwords at all costs. Hackers can guess them in under five seconds!

123456

This is the gold standard for bad passwords. It has topped the most-hacked lists for years because it’s the first thing hackers try. Why? Because it’s mindlessly simple. Password-cracking programs will run through sequences like this in milliseconds.

password

It doesn’t get lazier than this. You’d be surprised how many people still think “password” is a decent choice. Cybercriminals know better. This has been exposed in countless data breaches, and hackers don’t even need fancy software to crack it.

123456789

Adding a few extra numbers doesn’t make it safer. In fact, it follows the same predictable pattern that automated hacking tools breeze through in no time. Even amateur hackers target it immediately, often as their second or third attempt.

12345

Short passwords are even worse. Anything under six characters is practically useless in today’s digital landscape. Hackers can cycle through every possible five-digit combination in under a second. Fun fact: some ATMs in the ’90s had five-digit PINs, and “12345” was the most commonly used one. No wonder banks changed that.

12345678

If "123456" is bad, slapping two more digits on the end isn’t going to fool anyone. This one shows up in every major database of exposed passwords, which means it’s already compromised. Just assume someone out there already has it.

qwerty

It might feel clever to use a keyboard pattern– the first six keys on your keyboard–but hackers are way ahead of you. They know people take the path of least resistance, so they check these layouts first, and that’s exactly why "Qwerty" has been a top weak password for decades.

abc123

A mix of letters and numbers sounds like a good idea—until you realize how many people use the same ones. This password has been leaked so many times that it’s practically worthless. It’s also a go-to choice for bot-generated fake accounts.

111111

Repetitive numbers are a disaster for security. If a password is easy for you to remember, it’s even easier for a hacker to guess. This one is at the top of every password-cracking program’s list, meaning it offers zero protection.

123123

It might look like a pattern that’s hard to guess, but hackers target repeating sequences right away. In fact, in large-scale credential-stuffing attacks, this is one of the first passwords they test—and it almost always works.

admin

Believe it or not, “admin” is still a common password—especially on routers, business accounts, and work logins. The problem is that it’s often a default setting, which means hackers don’t even have to guess.

football

Sports-related passwords are easy to guess because fans tend to use their favorite teams or sports. During football season, security reports show an increase in passwords like “superbowl,” “cowboys,” and “gochiefs.” Hackers keep track of trends, too.

iloveyou

It might be a sweet sentiment, but it’s terrible for security. Hackers know people use emotional words and phrases, so they check them first. If you want to keep your accounts safe, save the love for text messages—not passwords.

654321

If “123456” is bad, flipping it around doesn’t make it any better. Hackers expect people to try simple variations, and if they attempt other passwords, they will likely attempt this one, too. It is just as weak as the original.

guest

This is another default password that people often forget to change. It’s commonly found in workplace accounts, public Wi-Fi setups, and old email accounts. Hackers love it because it usually means no extra security steps were taken.

dragon

Fantasy fans made this one wildly popular, and hackers know it. “dragon” has appeared in major password breach dumps since the early 2000s, riding the wave of gaming culture and blockbuster franchises. Cybersecurity analysts still flag it as one of the most common word-based passwords in circulation. If your password sounds like a mythical beast, treat it like one—keep it far, far away from your login screen.

letmein

If your password is basically begging for access, it’s a bad sign. “letmein” has been a weak password choice for over a decade and remains one of the most breached. Ironically, it’s so common that hackers can easily keep you locked out.

Skibidi (and Other Meme-Speak)

Passwords constructed from popular slang or internet phrases are risky because they frequently appear in leaked password databases. Hackers rely on massive wordlists created from real breaches, not guesswork. If a term trends online and people reuse it for logins, cracking tools can identify and test it almost instantly.

Jessica1987 (Name + Birth Year)

This format is a hacker favorite because it shows up everywhere. First name plus birth year is straightforward to guess, especially with social media profiles revealing birthdays. Password-cracking tools automatically test common names paired with years from 1960 to 2005. It feels personal, but it’s painfully predictable.