# NCSC password list: The common passwords attackers rely on most The common passwords attackers rely on most, and how you can combat them with password deny lists, also called password blacklists. Learn more today! --- ## Why did the NCSC focus on breached passwords? The UK's National Cyber Security Centre (NCSC) [compiled its password list](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt) from global breach data: billions of credentials leaked across thousands of incidents. Though the NCSC is a UK agency, the list reflects worldwide patterns in compromised passwords, making it a useful reference for understanding what weak passwords look like in practice. When the [NCSC first compiled the list](https://www.ncsc.gov.uk/news/most-hacked-passwords-revealed-as-uk-cyber-survey-exposes-gaps-in-online-security), "123456" appeared in 23.2 million breached accounts worldwide, all of which used the same obvious password. ‘Have I Been Pwned’ (HIBP), a [website chronicling data breaches and compromised passwords](https://haveibeenpwned.com/Passwords), most recently puts the number of accounts using “123456” that have been breached at over 210 million. That figure reflects how rarely people make deliberate password choices when left to their own devices. Password deny lists, also called password blacklists, block commonly compromised credentials during account creation or password resets. The NCSC password list is one of the key sources that informs those controls. The patterns it exposes also reveal a great deal about how attackers approach the problem. | **Sequential numbers** | 123456 | Extremely common across all demographics; tested in nearly every attack | |------|------|------| | **Keyboard walks** | qwerty, qwertyuiop | Predictable physical patterns that are easy to automate | | **Single dictionary words** | password, dragon | Small wordlists cover millions of accounts in minutes | | **Slight variations** | P@ssword1, passw0rd | Standard substitution rules are built into attack tooling | ## How attackers use the NCSC list Knowing which passwords are weak is only half the picture. The other half is understanding how that knowledge gets turned into access. Consider a realistic scenario: a user's email and password are exposed in a breach at a retail site. That leaked pair is added to a credential database circulated among attackers. Automated tools then test that combination against hundreds of other sites, from banking apps to email providers. Each attempt takes seconds and requires no manual effort. Three techniques drive most credential-based breaches. ### **Credential stuffing at scale** Credential stuffing uses breached username and password pairs and automatically tests them across multiple services. Because many people reuse passwords, credentials from a year-old breach can often still be used to open accounts on unrelated platforms. The [2025 Verizon Data Breach Investigations Report](https://www.verizon.com/business/resources/articles/credential-stuffing-attacks-2025-dbir-research/) found compromised credentials were an initial access vector in 22% of reviewed breaches, more than one in five.  Enabling multifactor authentication (MFA) closes that gap; a stolen password alone is not enough to get in when a second factor is required. ### **Password spraying and brute force** Password spraying targets a large number of accounts using a small set of common passwords, often drawn from lists such as the NCSC password list. The method stays below lockout thresholds while still succeeding at scale. A brute-force attack takes a different approach, systematically testing every possible combination within a character space. Short, simple passwords are quickly cracked; strong, unique ones are not. ## What the most common password patterns reveal The attacker techniques above all rely on one thing: predictability. The NCSC list exposes just how predictable most password choices are. Number strings, keyboard walks, first names, sports teams, and pop culture references all appear in enormous volumes, as do slight modifications to the word "password" itself. Familiar words feel memorable. They are also among the easiest to guess. Letter-for-number substitutions ("a" to "@", "e" to "3") follow rules built directly into attack tooling. Complexity tricks do not significantly improve resistance. The NCSC recommends a long passphrase made of three random words because it is harder to crack than a shorter password with symbols added. ### **Number strings and keyboard walks are tested first** Sequences like "123456" and "111111," along with keyboard patterns like "qwerty" and "zxcvbn," appear in breach data at volumes that make them essentially useless as passwords. Attackers test these first; the success rate against large account sets is high. ### **Personal words offer less protection than most people assume** First names, place names, sports teams, and fan references feel personal and unique. In practice, the most popular examples appear in millions of accounts. If a word appears in a dictionary, a list, or popular culture, it is already in attacker tooling. ## A quick checklist: strengthening password security Understanding the patterns is only useful if it leads to action. The most important step is replacing weak or reused passwords, starting with the accounts that carry the most risk. ### **Start with the highest-risk accounts** Not all accounts carry the same risk. Prioritize replacing reused or compromised passwords in this order: - **Email accounts**: these control password resets for nearly everything else - **Financial accounts**: banking, investment, and payment platforms - Any account where the **same password**is used across multiple sites - Accounts that store **sensitive personal**or health information After updating credentials, enable MFA on every account that supports it. A[ secure family vault](https://bitwarden.com/ja-jp/products/families/) makes it practical to extend these protections across an entire household. ### **Generate and store stronger passwords** The NCSC recommends starting with a passphrase of three random words, which is longer and less predictable than most passwords people create on their own. A password generator takes this further, producing random, unique strings with no resemblance to dictionary words, names, or patterns. These credentials do not appear on deny lists and do not need to be memorized. A password manager stores them across every device, removing the temptation to reuse passwords across sites. ## How Bitwarden addresses common password risk The checklist above is simple in principle. Executing it across dozens of accounts is where most people stall. The Bitwarden Password Manager is built for exactly that: replacing scattered, manual password habits with a system that works automatically. ### **Password monitoring and safer replacements** A built-in password generator produces strong, unique credentials on demand. Cross-device sync keeps those credentials accessible wherever they are needed. The [Bitwarden Vault Health Reports](https://bitwarden.com/ja-jp/help/reports/) surface weak, reused, or exposed passwords on demand. The exposed passwords report identifies passwords that have been uncovered in known data breaches that were released publicly or sold on the dark web by hackers. This report uses a trusted web service to search the first five characters of the hash of all a user’s passwords in a database of known leaked passwords. The returned matching list of hashes is then locally compared with the full hash of a user’s passwords. This is done to preserve k-anonymity: by sending only the first five characters of the hash, the query could correspond to hundreds of different passwords, making it impossible for the service to determine which specific password is being checked.  Bitwarden is[ open source and independently audited](https://bitwarden.com/ja-jp/open-source/), which means the security architecture is verifiable rather than assumed. ## Use a password manager for overall password protection Weak credentials remain one of the most reliable ways for attackers to gain access to accounts, and the NCSC password list is a direct record of this. A[ personal password manager](https://bitwarden.com/ja-jp/download/) makes it practical to replace exposed or reused passwords, generate stronger credentials, and protect every account with MFA.[ Install Bitwarden](https://bitwarden.com/ja-jp/download/) to get all three in one place. ## NCSC Password List FAQ **What is the NCSC password list?** The NCSC password list is a collection of commonly compromised passwords compiled by the UK's National Cyber Security Centre from global breach data. It is used to inform password deny lists: controls that block weak or previously breached credentials at account creation or password reset. Although the NCSC is a UK agency, the list draws on worldwide breach data and is relevant to users globally. **How do attackers use lists of common passwords?** Attackers use common password lists in several ways. Credential stuffing tools automatically test breached username-password pairs across hundreds of sites. Password spraying uses a short list of common passwords against large numbers of accounts to avoid reaching lockout thresholds. Brute force attacks systematically try combinations within a character space. In all three cases, predictable passwords (short words, number sequences, and slight variations) are the ones that fall first. **What are the most commonly breached passwords?** Sequential numbers like "123456," keyboard patterns like "qwerty," single dictionary words like "password" or "dragon," and predictable substitutions like "P@ssword1" consistently top breach data. As mentioned above, a HIBP search shows that “123456’ appeared in over 200 million breached accounts worldwide. **Does password complexity actually help?** Not as much as most people assume. Letter-for-number substitutions and added symbols follow predictable rules that are already built into attack tooling. Length matters more than complexity. The NCSC recommends using a passphrase made of three random words because it is longer and less predictable than a short password with symbols, making it significantly harder to crack. **What does NCSC recommend for better passwords?** The NCSC recommends using a passphrase of three random words, enabling MFA on all accounts, and using a password manager to generate and store unique credentials. Using a password manager also makes it easier to avoid reusing passwords across sites. For more context on small business and personal security guidance, see[cybersecurity advice for small businesses](https://www.ncsc.gov.uk/section/advice-guidance/small-medium-sized-organisations) from the NCSC. **How does a password manager help with the risks on the NCSC list?** A password manager generates strong, random credentials that look nothing like dictionary words or common patterns, meaning they do not appear on deny lists. It stores those credentials securely across devices, removing the need to memorize or reuse passwords. Vault health reports identify weak, reused, or exposed passwords so users know exactly which accounts to update first.[ Securing a password vault with MFA](https://bitwarden.com/ja-jp/help/setup-two-step-login/) adds a further layer of protection. ## 強力で信頼できるパスワードセキュリティを今すぐ。プランを選択してください。 ## パーソナル ### 始めたばかりですか？ *今すぐ、基本的なパスワード管理を始めましょう。ずっと無料です。* *月あたり* *永久無料* Bitwardenの保管庫を利用する ボールトのアイテムを他の 1 人のユーザーと共有する [今すぐ利用開始](https://bitwarden.com/go/start-free/) --- ### プレミアム **$1.65** *月あたり* *年間 $19.80 ドル請求されます* プレミアム機能をお楽しみください - Bitwarden 認証器 - ファイル添付 - 緊急アクセス - フィッシング対策 - セキュリティレポートなど ボールトのアイテムを他の 1 人のユーザーと共有する [プレミアム アカウントを作成する](https://bitwarden.com/go/start-premium/) --- ### 家族 **$3.99** *月あたり* *最大 6 ユーザー、年間 $47.88 請求されます* あなたの家族のログインを保護してください - 6 つのプレミアムアカウント - 無制限の共有 - 無制限のコレクション - 組織のストレージ ボールトのアイテムを 6 人で共有する [ファミリープランの無料トライアルを開始](https://bitwarden.com/go/start-families-trial/) --- 価格は米ドルで表示され、年間サブスクリプションに基づいています。税別。 ## ビジネス ### チーム *成長するチームのための強固な保護* **$4** *月額/ユーザーごとに毎年請求* **妥協なし** 同僚、部門間、または全社と安全に機密データを共有する - 認証情報を安全に共有する - イベントログでアクティビティを追跡する - 既存のディレクトリを同期する - SCIM によるプロビジョニングの自動化 すべてのユーザーにプレミアム機能を含む [トライアルを開始する](https://bitwarden.com/go/start-teams-trial/) --- ### 企業 *大規模組織向けの高度な機能* **$6** *月額/ユーザーごとに毎年請求* **最大限の保護** エンタープライズ ポリシー、パスワードなしの SSO、アカウントの回復などの高度な機能を利用する。 - きめ細かなアクセス制御 - パスワードレスSSO統合 - 簡単なアカウント回復 - セルフホストの柔軟性 - アクセス・インテリジェンスのリスク修復 [新規］ - すべてのユーザー向けの無料ファミリープラン すべてのユーザー向けのプレミアム機能と補完的なファミリー プランが含まれる [トライアルを開始する](https://bitwarden.com/go/start-enterprise-trial/) --- ### 営業に問い合わせる *数百人または数千人の従業員を持つ企業のために、カスタム見積もりを取得するために営業に連絡し、Bitwarden がどのように役立つかを確認してください：* *per month* - サイバーセキュリティ リスクを軽減する - 生産性を向上させる - シームレスに統合する Bitwarden は、パスワードのセキュリティを貴組織にもたらすために、どんな規模のビジネスにも対応する。 [営業に問い合わせる](https://bitwarden.com/talk-to-sales) --- 価格は米ドルで表示され、年間サブスクリプションに基づいています。税別。