Cybersecurity warning as Australians cling to passwords hackers can crack in seconds
You won’t believe the passwords being used by tens of thousands of Aussies! SEE THE LIST
Australians could be leaving the door open to hackers by using passwords as basic as “123456” and “password”, with a national report finding almost half of online Australians surveyed had experienced cybercrime in the previous 12 months.
The embarrassing password habits come as an analysis of exposed logins shows millions of people worldwide are still relying on combinations criminals can easily guess.
In Australia, the three most commonly used passwords are “admin”, “password” and “123456”, according to password security research cited by ANZ in June.
Sign up to The Nightly's newsletters.
Get the first look at the digital newspaper, curated daily stories and breaking headlines delivered to your inbox.
By continuing you agree to our Terms and Privacy Policy.Each is used by tens of thousands of Australians, despite years of warnings about the dangers of weak passwords.
And the problem is not just about people choosing an easy code for their Netflix account.
The Australian Institute of Criminology’s Cybercrime in Australia 2025 report found 47 per cent of 10,593 online Australians surveyed had experienced at least one form of cybercrime in the previous 12 months.
Separately, the Australian Signals Directorate’s Australian Cyber Security Centre received more than 84,700 cybercrime reports in 2024–25, while the average self-reported financial loss for individual victims reached $33,000.
The agency also responded to more than 1200 cyber security incidents during the year, an increase of 11 per cent on the previous financial year.
Stolen passwords can give criminals a way into personal email, social media and financial accounts — particularly when people reuse the same login details across multiple services.
The global password analysis cited by British insurance firm Alan Boswell Group found “123456” had been used by about 210 million people, while more than 52 million had chosen “password”.
About 2.5 million used “computer”.
Soccer teams and bands also featured prominently, with Chelsea and Metallica among the names appearing in exposed password lists.
The figures were drawn from information tracked by Have I Been Pwned, a website that records passwords exposed in data breaches.
Alan Boswell Group spokesman Heath Alexander-Bew warned that weak passwords could quickly expose sensitive information.
“For individuals, it could mean someone accessing shopping accounts, banking apps or social media,” he said.
“For a business, it could open the door to invoices, customer details, internal files or password reset links for other platforms.”
Mr Alexander-Bew said criminals did not always need to guess passwords because many were already circulating in leaked databases.
“They’re sitting in leaked password lists,” he said. “Criminals can use automated tools to try them across different sites.
“That is why passwords such as ‘123456’, ‘admin’, a football team, a name or a birth year can still be risky, especially when reused across work and personal accounts.”
A global analysis by password manager NordPass and cybersecurity researchers NordStellar examined exposed passwords from public data breaches and dark web repositories collected between September 2024 and September 2025.
The researchers analysed password trends across 44 countries and found “123456” had topped the global rankings in six of the past seven years.
Other familiar combinations, including “password”, “12345678” and “123456789” also featured prominently.
The research found weak password habits persisted across generations, challenging the assumption that younger people who grew up with technology were naturally better at protecting themselves online.
NordPass said the password habits of an 18-year-old were strikingly similar to those of an 80-year-old, with simple numerical sequences popular across age groups.
The analysis also identified recurring patterns including familiar words, names combined with numbers and predictable keyboard sequences.
The national cyber security centre recommends using strong, unique passwords or passphrases, enabling multi-factor authentication wherever possible and keeping devices and software updated.
THE 20 PASSWORDS TO AVOID
- 123456
- 123456789
- 12345678
- password
- qwerty123
- qwerty1
- 111111
- 12345
- secret
- 123123
- 1234567890
- 1234567
- 000000
- qwerty
- abc123
- password1
- iloveyou
- 11111111
- dragon
- monkey
Based on a 2025 list of commonly exposed passwords used by Australians, compiled using NordPass data.
OTHERS TO AVOID
- admin
- admin123
- Pass@123
- P@ssw0rd
- Password1!
- Your name, date of birth or other personal details
- Repeated characters, such as aaaaaa
- Keyboard sequences, such as asdfgh or 1q2w3e
