The UK's National Cyber Security Centre (NCSC) compiled its password list from global breach data: billions of credentials leaked across thousands of incidents. Though the NCSC is a UK agency, the list reflects worldwide patterns in compromised passwords, making it a useful reference for understanding what weak passwords look like in practice.
When the NCSC first compiled the list, "123456" appeared in 23.2 million breached accounts worldwide, all of which used the same obvious password. ‘Have I Been Pwned’ (HIBP), a website chronicling data breaches and compromised passwords, most recently puts the number of accounts using “123456” that have been breached at over 210 million. That figure reflects how rarely people make deliberate password choices when left to their own devices.
Password deny lists, also called password blacklists, block commonly compromised credentials during account creation or password resets. The NCSC password list is one of the key sources that informs those controls. The patterns it exposes also reveal a great deal about how attackers approach the problem.
Sequential numbers | 123456 | Extremely common across all demographics; tested in nearly every attack |
Keyboard walks | qwerty, qwertyuiop | Predictable physical patterns that are easy to automate |
Single dictionary words | password, dragon | Small wordlists cover millions of accounts in minutes |
Slight variations | P@ssword1, passw0rd | Standard substitution rules are built into attack tooling |
Knowing which passwords are weak is only half the picture. The other half is understanding how that knowledge gets turned into access.
Consider a realistic scenario: a user's email and password are exposed in a breach at a retail site. That leaked pair is added to a credential database circulated among attackers. Automated tools then test that combination against hundreds of other sites, from banking apps to email providers. Each attempt takes seconds and requires no manual effort.
Three techniques drive most credential-based breaches.
Credential stuffing uses breached username and password pairs and automatically tests them across multiple services. Because many people reuse passwords, credentials from a year-old breach can often still be used to open accounts on unrelated platforms.
The 2025 Verizon Data Breach Investigations Report found compromised credentials were an initial access vector in 22% of reviewed breaches, more than one in five.
Enabling multifactor authentication (MFA) closes that gap; a stolen password alone is not enough to get in when a second factor is required.
Password spraying targets a large number of accounts using a small set of common passwords, often drawn from lists such as the NCSC password list. The method stays below lockout thresholds while still succeeding at scale.
A brute-force attack takes a different approach, systematically testing every possible combination within a character space. Short, simple passwords are quickly cracked; strong, unique ones are not.
The attacker techniques above all rely on one thing: predictability. The NCSC list exposes just how predictable most password choices are.
Number strings, keyboard walks, first names, sports teams, and pop culture references all appear in enormous volumes, as do slight modifications to the word "password" itself. Familiar words feel memorable. They are also among the easiest to guess.
Letter-for-number substitutions ("a" to "@", "e" to "3") follow rules built directly into attack tooling. Complexity tricks do not significantly improve resistance. The NCSC recommends a long passphrase made of three random words because it is harder to crack than a shorter password with symbols added.
Sequences like "123456" and "111111," along with keyboard patterns like "qwerty" and "zxcvbn," appear in breach data at volumes that make them essentially useless as passwords. Attackers test these first; the success rate against large account sets is high.
First names, place names, sports teams, and fan references feel personal and unique. In practice, the most popular examples appear in millions of accounts. If a word appears in a dictionary, a list, or popular culture, it is already in attacker tooling.
Understanding the patterns is only useful if it leads to action. The most important step is replacing weak or reused passwords, starting with the accounts that carry the most risk.
Not all accounts carry the same risk. Prioritize replacing reused or compromised passwords in this order:
Email accounts: these control password resets for nearly everything else
Financial accounts: banking, investment, and payment platforms
Any account where the same password is used across multiple sites
Accounts that store sensitive personal or health information
After updating credentials, enable MFA on every account that supports it. A secure family vault makes it practical to extend these protections across an entire household.
The NCSC recommends starting with a passphrase of three random words, which is longer and less predictable than most passwords people create on their own. A password generator takes this further, producing random, unique strings with no resemblance to dictionary words, names, or patterns. These credentials do not appear on deny lists and do not need to be memorized. A password manager stores them across every device, removing the temptation to reuse passwords across sites.
The checklist above is simple in principle. Executing it across dozens of accounts is where most people stall. The Bitwarden Password Manager is built for exactly that: replacing scattered, manual password habits with a system that works automatically.
A built-in password generator produces strong, unique credentials on demand. Cross-device sync keeps those credentials accessible wherever they are needed. The Bitwarden Vault Health Reports surface weak, reused, or exposed passwords on demand. The exposed passwords report identifies passwords that have been uncovered in known data breaches that were released publicly or sold on the dark web by hackers. This report uses a trusted web service to search the first five characters of the hash of all a user’s passwords in a database of known leaked passwords. The returned matching list of hashes is then locally compared with the full hash of a user’s passwords. This is done to preserve k-anonymity: by sending only the first five characters of the hash, the query could correspond to hundreds of different passwords, making it impossible for the service to determine which specific password is being checked.
Bitwarden is open source and independently audited, which means the security architecture is verifiable rather than assumed.
Weak credentials remain one of the most reliable ways for attackers to gain access to accounts, and the NCSC password list is a direct record of this. A personal password manager makes it practical to replace exposed or reused passwords, generate stronger credentials, and protect every account with MFA. Install Bitwarden to get all three in one place.
What is the NCSC password list?
The NCSC password list is a collection of commonly compromised passwords compiled by the UK's National Cyber Security Centre from global breach data. It is used to inform password deny lists: controls that block weak or previously breached credentials at account creation or password reset. Although the NCSC is a UK agency, the list draws on worldwide breach data and is relevant to users globally.
How do attackers use lists of common passwords?
Attackers use common password lists in several ways. Credential stuffing tools automatically test breached username-password pairs across hundreds of sites. Password spraying uses a short list of common passwords against large numbers of accounts to avoid reaching lockout thresholds. Brute force attacks systematically try combinations within a character space. In all three cases, predictable passwords (short words, number sequences, and slight variations) are the ones that fall first.
What are the most commonly breached passwords?
Sequential numbers like "123456," keyboard patterns like "qwerty," single dictionary words like "password" or "dragon," and predictable substitutions like "P@ssword1" consistently top breach data. As mentioned above, a HIBP search shows that “123456’ appeared in over 200 million breached accounts worldwide.
Does password complexity actually help?
Not as much as most people assume. Letter-for-number substitutions and added symbols follow predictable rules that are already built into attack tooling. Length matters more than complexity. The NCSC recommends using a passphrase made of three random words because it is longer and less predictable than a short password with symbols, making it significantly harder to crack.
What does NCSC recommend for better passwords?
The NCSC recommends using a passphrase of three random words, enabling MFA on all accounts, and using a password manager to generate and store unique credentials. Using a password manager also makes it easier to avoid reusing passwords across sites. For more context on small business and personal security guidance, seecybersecurity advice for small businesses from the NCSC.
How does a password manager help with the risks on the NCSC list?
A password manager generates strong, random credentials that look nothing like dictionary words or common patterns, meaning they do not appear on deny lists. It stores those credentials securely across devices, removing the need to memorize or reuse passwords. Vault health reports identify weak, reused, or exposed passwords so users know exactly which accounts to update first. Securing a password vault with MFA adds a further layer of protection.