# NCSC password list: The common passwords attackers rely on most The common passwords attackers rely on most, and how you can combat them with password deny lists, also called password blacklists. Learn more today! --- ## Why did the NCSC focus on breached passwords? The UK's National Cyber Security Centre (NCSC) [compiled its password list](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt) from global breach data: billions of credentials leaked across thousands of incidents. Though the NCSC is a UK agency, the list reflects worldwide patterns in compromised passwords, making it a useful reference for understanding what weak passwords look like in practice. When the [NCSC first compiled the list](https://www.ncsc.gov.uk/news/most-hacked-passwords-revealed-as-uk-cyber-survey-exposes-gaps-in-online-security), "123456" appeared in 23.2 million breached accounts worldwide, all of which used the same obvious password. ‘Have I Been Pwned’ (HIBP), a [website chronicling data breaches and compromised passwords](https://haveibeenpwned.com/Passwords), most recently puts the number of accounts using “123456” that have been breached at over 210 million. That figure reflects how rarely people make deliberate password choices when left to their own devices. Password deny lists, also called password blacklists, block commonly compromised credentials during account creation or password resets. The NCSC password list is one of the key sources that informs those controls. The patterns it exposes also reveal a great deal about how attackers approach the problem. | **Sequential numbers** | 123456 | Extremely common across all demographics; tested in nearly every attack | |------|------|------| | **Keyboard walks** | qwerty, qwertyuiop | Predictable physical patterns that are easy to automate | | **Single dictionary words** | password, dragon | Small wordlists cover millions of accounts in minutes | | **Slight variations** | P@ssword1, passw0rd | Standard substitution rules are built into attack tooling | ## How attackers use the NCSC list Knowing which passwords are weak is only half the picture. The other half is understanding how that knowledge gets turned into access. Consider a realistic scenario: a user's email and password are exposed in a breach at a retail site. That leaked pair is added to a credential database circulated among attackers. Automated tools then test that combination against hundreds of other sites, from banking apps to email providers. Each attempt takes seconds and requires no manual effort. Three techniques drive most credential-based breaches. ### **Credential stuffing at scale** Credential stuffing uses breached username and password pairs and automatically tests them across multiple services. Because many people reuse passwords, credentials from a year-old breach can often still be used to open accounts on unrelated platforms. The [2025 Verizon Data Breach Investigations Report](https://www.verizon.com/business/resources/articles/credential-stuffing-attacks-2025-dbir-research/) found compromised credentials were an initial access vector in 22% of reviewed breaches, more than one in five.  Enabling multifactor authentication (MFA) closes that gap; a stolen password alone is not enough to get in when a second factor is required. ### **Password spraying and brute force** Password spraying targets a large number of accounts using a small set of common passwords, often drawn from lists such as the NCSC password list. The method stays below lockout thresholds while still succeeding at scale. A brute-force attack takes a different approach, systematically testing every possible combination within a character space. Short, simple passwords are quickly cracked; strong, unique ones are not. ## What the most common password patterns reveal The attacker techniques above all rely on one thing: predictability. The NCSC list exposes just how predictable most password choices are. Number strings, keyboard walks, first names, sports teams, and pop culture references all appear in enormous volumes, as do slight modifications to the word "password" itself. Familiar words feel memorable. They are also among the easiest to guess. Letter-for-number substitutions ("a" to "@", "e" to "3") follow rules built directly into attack tooling. Complexity tricks do not significantly improve resistance. The NCSC recommends a long passphrase made of three random words because it is harder to crack than a shorter password with symbols added. ### **Number strings and keyboard walks are tested first** Sequences like "123456" and "111111," along with keyboard patterns like "qwerty" and "zxcvbn," appear in breach data at volumes that make them essentially useless as passwords. Attackers test these first; the success rate against large account sets is high. ### **Personal words offer less protection than most people assume** First names, place names, sports teams, and fan references feel personal and unique. In practice, the most popular examples appear in millions of accounts. If a word appears in a dictionary, a list, or popular culture, it is already in attacker tooling. ## A quick checklist: strengthening password security Understanding the patterns is only useful if it leads to action. The most important step is replacing weak or reused passwords, starting with the accounts that carry the most risk. ### **Start with the highest-risk accounts** Not all accounts carry the same risk. Prioritize replacing reused or compromised passwords in this order: - **Email accounts**: these control password resets for nearly everything else - **Financial accounts**: banking, investment, and payment platforms - Any account where the **same password**is used across multiple sites - Accounts that store **sensitive personal**or health information After updating credentials, enable MFA on every account that supports it. A[ secure family vault](https://bitwarden.com/fr-fr/products/families/) makes it practical to extend these protections across an entire household. ### **Generate and store stronger passwords** The NCSC recommends starting with a passphrase of three random words, which is longer and less predictable than most passwords people create on their own. A password generator takes this further, producing random, unique strings with no resemblance to dictionary words, names, or patterns. These credentials do not appear on deny lists and do not need to be memorized. A password manager stores them across every device, removing the temptation to reuse passwords across sites. ## How Bitwarden addresses common password risk The checklist above is simple in principle. Executing it across dozens of accounts is where most people stall. The Bitwarden Password Manager is built for exactly that: replacing scattered, manual password habits with a system that works automatically. ### **Password monitoring and safer replacements** A built-in password generator produces strong, unique credentials on demand. Cross-device sync keeps those credentials accessible wherever they are needed. The [Bitwarden Vault Health Reports](https://bitwarden.com/fr-fr/help/reports/) surface weak, reused, or exposed passwords on demand. The exposed passwords report identifies passwords that have been uncovered in known data breaches that were released publicly or sold on the dark web by hackers. This report uses a trusted web service to search the first five characters of the hash of all a user’s passwords in a database of known leaked passwords. The returned matching list of hashes is then locally compared with the full hash of a user’s passwords. This is done to preserve k-anonymity: by sending only the first five characters of the hash, the query could correspond to hundreds of different passwords, making it impossible for the service to determine which specific password is being checked.  Bitwarden is[ open source and independently audited](https://bitwarden.com/fr-fr/open-source/), which means the security architecture is verifiable rather than assumed. ## Use a password manager for overall password protection Weak credentials remain one of the most reliable ways for attackers to gain access to accounts, and the NCSC password list is a direct record of this. A[ personal password manager](https://bitwarden.com/fr-fr/download/) makes it practical to replace exposed or reused passwords, generate stronger credentials, and protect every account with MFA.[ Install Bitwarden](https://bitwarden.com/fr-fr/download/) to get all three in one place. ## NCSC Password List FAQ **What is the NCSC password list?** The NCSC password list is a collection of commonly compromised passwords compiled by the UK's National Cyber Security Centre from global breach data. It is used to inform password deny lists: controls that block weak or previously breached credentials at account creation or password reset. Although the NCSC is a UK agency, the list draws on worldwide breach data and is relevant to users globally. **How do attackers use lists of common passwords?** Attackers use common password lists in several ways. Credential stuffing tools automatically test breached username-password pairs across hundreds of sites. Password spraying uses a short list of common passwords against large numbers of accounts to avoid reaching lockout thresholds. Brute force attacks systematically try combinations within a character space. In all three cases, predictable passwords (short words, number sequences, and slight variations) are the ones that fall first. **What are the most commonly breached passwords?** Sequential numbers like "123456," keyboard patterns like "qwerty," single dictionary words like "password" or "dragon," and predictable substitutions like "P@ssword1" consistently top breach data. As mentioned above, a HIBP search shows that “123456’ appeared in over 200 million breached accounts worldwide. **Does password complexity actually help?** Not as much as most people assume. Letter-for-number substitutions and added symbols follow predictable rules that are already built into attack tooling. Length matters more than complexity. The NCSC recommends using a passphrase made of three random words because it is longer and less predictable than a short password with symbols, making it significantly harder to crack. **What does NCSC recommend for better passwords?** The NCSC recommends using a passphrase of three random words, enabling MFA on all accounts, and using a password manager to generate and store unique credentials. Using a password manager also makes it easier to avoid reusing passwords across sites. For more context on small business and personal security guidance, see[cybersecurity advice for small businesses](https://www.ncsc.gov.uk/section/advice-guidance/small-medium-sized-organisations) from the NCSC. **How does a password manager help with the risks on the NCSC list?** A password manager generates strong, random credentials that look nothing like dictionary words or common patterns, meaning they do not appear on deny lists. It stores those credentials securely across devices, removing the need to memorize or reuse passwords. Vault health reports identify weak, reused, or exposed passwords so users know exactly which accounts to update first.[ Securing a password vault with MFA](https://bitwarden.com/fr-fr/help/setup-two-step-login/) adds a further layer of protection. ## Profitez dès maintenant d’une sécurité des mots de passe puissante et fiable. Choisissez votre offre. ## Personnel ### Vous débutez ? *Bénéficiez dès aujourd'hui d'une gestion basique des mots de passe. Toujours gratuit.* *par mois* *Gratuit pour toujours* Profitez d'un coffre-fort Bitwarden Partager des éléments du coffre-fort avec un autre utilisateur [Commencez dès aujourd'hui](https://bitwarden.com/go/start-free/) --- ### Premium **$1.65** *par mois* *$19.80 facturés annuellement* Profitez des fonctionnalités premium - Bitwarden Authenticator - Pièces jointes - Accès d'urgence - Bloqueur de phishing - Rapports de sécurité et plus encore Partager des éléments du coffre-fort avec un autre utilisateur [Créer un compte premium](https://bitwarden.com/go/start-premium/) --- ### Familles **$3.99** *par mois* *Jusqu'à 6 utilisateurs, 47.88 $ facturés annuellement* Sécuriser vos identifiants familiaux - 6 comptes premium - Partage illimité - Collections illimitées - Organisation du stockage Partager les éléments du coffre-fort entre six personnes [Commencer l’essai gratuit Families](https://bitwarden.com/go/start-families-trial/) --- Les prix sont indiqués en USD et sont basés sur un abonnement annuel. Les taxes ne sont pas incluses. ## Entreprises ### Équipes *Protection résiliente pour les équipes en croissance* **$4** *par mois / par utilisateur facturé annuellement* **Aucun compromis** Partagez des données sensibles en toute sécurité avec des collègues, à travers les départements ou l'ensemble de l'entreprise - Partagez vos identifiants en toute sécurité - Suivez l'activité grâce aux journaux d'événements - Synchronisez votre répertoire existant - Automatisez le provisionnement avec SCIM Inclut des fonctionnalités premium pour tous les utilisateurs [Commencer l’essai gratuit](https://bitwarden.com/go/start-teams-trial/) --- ### Entreprise *Fonctionnalités avancées pour les grandes organisations* **$6** *par mois / par utilisateur facturé annuellement* **Protection maximale** Utilisez des fonctionnalités avancées, notamment des politiques d'entreprise, la connexion sans mot de passe unique (SSO) et la récupération de compte. - Contrôle d'accès granulaire - Intégration SSO sans mot de passe - Possibilité d'auto-hébergement - Access Intelligence risk remediation [nouveau] - Plan familial gratuit pour tous les utilisateurs Inclut des fonctionnalités premium et un plan familial gratuit pour tous les utilisateurs [Commencer l’essai gratuit](https://bitwarden.com/go/start-enterprise-trial/) --- ### Contacter le service commercial *Pour les entreprises comptant des centaines ou des milliers d'employés, veuillez contacter notre service commercial pour obtenir un devis personnalisé et voir comment Bitwarden peut vous aider :* *per month* - Réduire les risques de cybersécurité - Augmentez la productivité - Intégrez-vous en toute transparence Bitwarden s'adapte à toutes les tailles d'entreprise pour garantir la sécurité des mots de passe au sein de votre organisation. [Contacter le service commercial](https://bitwarden.com/talk-to-sales) --- Les prix sont indiqués en USD et sont basés sur un abonnement annuel. Les taxes ne sont pas incluses.