What ‘123456’ reveals about human behaviour in the digital age

For all the talk of rising cyber-threats, digital sophistication and the inexorable march of artificial intelligence, one thing remains disconcertingly primitive: the passwords people choose to protect their online lives. According to a new report by NordPass, compiled with researchers from NordStellar, the world’s most common password is once again “123456” — a sequence so feeble that it barely qualifies as a lock at all.

The study analysed credentials found in publicly exposed databases between September 2024 and September 2025. The results form a kind of anthropological survey of the digital age. Across generations, countries and platforms, users continue to favour passwords that are short, predictable and instantly guessable. 

Younger cohorts, who are often presumed to be digital natives, prove just as culpable as older ones. Human behaviour, it seems, is far more consistent than technology.

Patterns emerge that feel almost quaint. Numeric strings dominate, as do simple variations on first names paired with birth years. Such choices reflect the enduring human preference for ease over effort, and for the familiar over the secure. 

Cybersecurity experts have advised users to keep long, unique passwords; combine characters; enable multi-factor authentication. Yet old habits seem to die hard.

This inertia carries real consequences. As attacks grow automated and criminals ever more sophisticated, the weakest link remains the individual user who cannot be bothered to move beyond the digital equivalent of leaving the key under the mat. 

Password managers, passkeys and other tools promise salvation, but only if people adopt them.

“123456” endures not merely because it is simple, but because it reveals something deeper about online life. Technology races ahead; human behaviour plods behind.