Warning issued to 40.8 million Brits putting themselves at risk with dangerous password habit

The new research found that on average, UK residents reuse passwords across roughly five different accounts, with one-fifth admitting they reuse the same password across 10 or more accounts. Yikes.

Even more concerning, NordPass research shows one-third of UK residents who reuse their passwords only have 12 regular "go-to" passwords that they cycle through across all of their accounts.

Head of Business Product at NordPass, Karolis Arbaciauskas said: "It’s possible that people only remember the five they use regularly.

"Our recent research shows that the average internet user has over 160 passwords, including work accounts. But some people may feel like they only have a handful of passwords and accounts because they use only about five platforms."

Surprisingly, the habit of reusing passwords spans across all demographics, with the survey finding no significant difference between men and women in reuse habits. However, Gen Z is more likely to reuse passwords, while Baby Boomers tend to have more accounts with reused passwords.

The dangers of this password reuse habit cannot be overstated, according to the experts.

Ms Arbaciauskas added: "People reuse passwords because it's easier that way, we all know that. But it is worrying that, despite repeated warnings, about 10% of respondents still don't think there's a significant risk in reusing passwords. This mindset is a disaster waiting to happen.

"Threat actors could gain access to all your accounts, your identity could be stolen and your credit card maxed out, or a loan could be taken out in your name."

If you belive your online account isn't valuable enough to become a target — think again.

Many of those surveyed by NordPass said they only used the same password for accounts they consider "less important" – a dangerous misconception according to Karolis Arbaciauskas, who stresses there really are no "less important" accounts when it comes to security.

That's because hackers will often target low-security sites first, using reused passwords to attempt logins on more critical accounts—a tactic known as credential stuffing.

Once one account is compromised, it can lead to identity theft, financial loss, or access to other linked services. Cybercriminals can piece together information from seemingly unimportant accounts to craft convincing phishing attempts or identity theft schemes.

Reusing passwords creates a single point of failure, so each account should have a unique, strong password to minimise risk and protect personal data across the web.

The most common modification is adding or changing a number, symbol, or letter – a tactic that provides little additional security. However, the survey found that around half of the people who reuse passwords and have 12 go-to passwords don't make any changes whatsoever when reusing them.

The latest research shared by NordPass follows a similar study by the same company last year that revealed concerning password habits among Britons. In 2024, "password" topped the list of most commonly used passwords in the UK, with "Password" (capitalised) also appearing in the top 20.

This marked a shift from 2023, when "123456" was the most popular choice.

Other common passwords included "qwerty123", "123456", "liverpool", "123456789", "password1", "qwerty", "liverpool1", and "arsenal".

Football references remain popular with "Arsenal," "Chelsea," and "Liverpool" all ranking in the top 20.

Simple keyboard combinations like "qwerty" and dictionary words continue to dominate despite being extremely vulnerable to cyberattacks. If you're using any of these passwords, you should change them immediately.

The research found that most of these common passwords can be cracked by hackers in under 10 seconds, with many being guessable in less than a second.

This marks a significant decline in password security compared to previous years. According to NordPass, 78% of common passwords are now crackable in under a second, up from 70% the previous year.

Cybersecurity researchers worked with the team at NordPass to put together the definitive list of the most common passwords of the year — the sixth annual report of its kind to improve password habits in the UK and globally.

To find the most common passwords, the security researchers scoured a database of 4.3TB (that's a whopping 4,300,000MB) extracted from a number of high-profile password leaks on the Dark Web to find the passwords that people relied on more than any others. NordPass only received statistical information from the researchers, there was no personal data included in the findings sent to the password management team.

With the average internet user now required to juggle 168 personal passwords and 87 work-related ones, it's understandable that people rely on the same very simple passwords time and time again.

The overlap between personal and work passwords presents a significant security concern, with research showing 40% of the most common passwords are identical across both domains.

Karolis Arbaciauskas, Head of Business Product at NordPass, explains this behaviour: "No matter if I wear a suit and tie at work or I’m scrolling through social media in my pajamas, I am still the same person.

"This means that regardless of the setting I am in, my password choices are influenced by the same criteria — usually convenience, personal experiences, or cultural surroundings. Businesses ignoring these considerations and leaving password management in their employees’ hands risk both their company’s and clients’ security online."

Experts at NordPass have issued several recommended security practices for better password strength.

First up, never reuse a password across accounts, as if even one of these username-password combinations is leaked or compromised, then it could lead to multiple security breaches.

NordPass recommends creating a strong password with at least 20 characters and a mixture of upper- and lower-case characters, numbers, and special characters. Personal information that could be easily guessed by those who know you – like birthdays, pet names, and hometowns – should be avoided. Always create a unique password for every online account, NordPass says.

If you're struggling to think of something, using the first letter from each word in a line of poetry, a saying, or a song lyric that you're unlikely to forget can be a great way to quickly generate what appears to be a completely random jumble of characters.

If you're struggling to think of something, then a password manager is a brilliant way to generate secure passwords for every account, with these stored in an encrypted safe that can be accessed from any of your devices. To login, most of these applications only require a quick biometric check – facial recognition on the iPhone or a fingerprint scan on Windows PCs and Android.

Passwords will be autofilled into the login screen, so there's no need to remember the unguessable combination of symbols, lowercase and capital letters, and numbers for your account.

NordPass is one option available alongside the likes of LastPass, Dashlane, and 1Password.

Switching to a password manager doesn't have to result in a new monthly subscription. Both Google and Apple offer built-in password managers with their most popular products, dubbed Google Password Manager and Passwords respectively, that generate and store passwords.

The latter was rebooted as a standalone application as part of the free upgrade toiOS 18 released in September for iPhone owners worldwide.

Lastly, NordPass suggests switching to passkeys where possible, noting that major providers like Google, Microsoft, and Apple now support this more secure alternative.

These allow you to sign-in to apps, websites, and other online accounts in the same manner that you unlock your device – using a fingerprint, a face, or an on-screen PIN.

Unlike passwords, passkeys are resistant to online attacks like phishing, making them more secure than one-time codes sent via SMS. Microsoft, Google, Apple and the FIDO Alliance are working together to bring passkeys to the web as an industry standard.

Although there are high hopes for passkeys, with Google even calling its rollout "the beginning of the end of the password", they're unlikely to eliminate old-fashioned passwords for some time. For the time being, we're still stuck with passwords for a huge number of our online accounts ...as such, it's time to ditch "password" and think of something a little stronger.

For organisations, implementing a comprehensive password policy is crucial, including the use of password managers and multi-factor authentication requirements. Security advice for enterprise security has changed dramatically over the year, with experts now warning against forcing employees to change their password multiple times per year.

• View Deal | Get started with 1Password for FREE
• View Deal | LastPass offers FREE 30-day trial
• View Deal | Lock-in NordPass' Black Friday deal for 99p

Cybersecurity researchers worked with the team at NordPass to put together the definitive list of the most common passwords of the year — the sixth annual report of its kind to improve password habits in the UK and globally. To find the most common passwords, the security researchers scoured a database of 4.3TB (that's a whopping 4,300,000MB) extracted from a number of high-profile password leaks on the Dark Web to find the passwords that people relied on more than any others. NordPass only received statistical information from the researchers, there was no personal data included in the findings sent to the password management team.

Top 20 Most Common Passwords In The UK

1. password
2. qwerty123
3. qwerty1
4. 123456
5. liverpool
6. 123456789
7. password1
8. qwerty
9. liverpool1
10. arsenal
11. 12345678
12. chelsea
13. Password
14. charlie
15. football
16. abc123
17. arsenal1
18. rangers
19. Password1
20. charlie1