TORONTO - Online security experts say there are a number of tactics to thwart hackers when it comes to passwords, including changing it regularly and using a hard-to-guess combination of letters, numbers, punctuation and symbols.

But perhaps the best piece of advice is not to use "password" as your password.

The California-based software company SplashData analyzed millions of stolen passwords that had been obtained by hackers and found some dangerously simple choices came up again and again.

The most common was "password," followed by "123456," "12345678," "qwerty," "abc123," "monkey," "1234567," "letmein," "trustno1," "dragon" and "baseball."

Users who have trouble remembering all their online passwords can buy software to automatically -- and securely -- log them into websites.

SplashData's version is SplashID, while the Canadian company AgileBits makes 1Password.


The full top 25 list of the worst online passwords, according to SplashData:

  • password
  • 123456
  • 12345678
  • qwerty
  • abc123
  • monkey
  • 1234567
  • letmein
  • trustno1
  • dragon
  • baseball
  • 111111
  • iloveyou
  • master
  • sunshine
  • ashley
  • bailey
  • passw0rd
  • shadow
  • 123123
  • 654321
  • superman
  • qazwsx
  • michael
  • Football