We may earn a commission when you buy through links in our articles. Learn more.

If your Steam password is on this list you really have to change it right now

Splashdata has published the worst online passwords from 5 million leaked accounts, the top 2 will come as no surprise

Worst passwords of 2018

If you recognise any of Splashdata’s top 100 worst passwords then it’s probably time to have a good long look at your online security levels. But we get it, everything from your private email, to your Amazon or Netflix accounts, to your various online game libraries, demands a unique login and password. Keeping tabs on every single one of these is a trial in itself.

Despite the different password vaults you can use to make it simple for yourself, we understand sometimes you might just want to throw a quick 123456 in when yet another niche online retailer demands a login for that Farming Simulator 2019 plushie you’re trying to buy.

But if you’re picking any of these 100 passwords for anything mission critical to your everyday life, then it’s worth getting just a little bit more cryptic about your profile details. Though if you’re still just using ‘password’ in these security-lacking days of ours you probably deserve everything you get…

Not all the seemingly dreadful passwords displayed on the list are as obvious, though at least the top 30 are variations on dragging your finger across the top alphanumeric lines of your keyboard. But if you thought ‘sunshine’ was fine, that actually pops up as the 8th worst password of the last year. Who knew?

The Splashdata list has reportedly been compiled from five million datasets that have been leaked out over the past year. To be honest the top of the list isn’t hugely surprising – general online ambivalence means that ‘123456’ and ‘password’ popping up as the absolute worst likely isn’t much different to what would have been sitting up there for any of the last ten years.

Read more: the best gaming keyboards to buy today

But it’s where people have tried to be clever, assuming security based on a combination of letters and numbers, that it’s maybe a little more concerning. And no, ‘passw0rd’ doesn’t count… ‘Zaq1zaq1,’ for example, looks like it ought to be secure – it is gibberish, after all – but because of the physical placement of the four characters on your keyboard it takes no time to crack.

The top 10 worst passwords of 2018 were:

  • 123456
  • password
  • 123456789
  • 12345678
  • 12345
  • 111111
  • 1234567
  • sunshine
  • qwerty
  • Iloveyou

Obviously a good portion of the leaked accounts associated to the worst passwords are going to be one-shot, throwaway logins for services that people either don’t care about, aren’t linked with any other profile, or are simple burner accounts.

But still, it’s nice feeling all smug about the fact that the only password I use – ‘dave’ – doesn’t appear on any of these lists.

I’m super-secure, me.