For years, the answer to “What is the most common password?” was a dull one: a string of numbers or the word “password” itself.

In the United States, the latest ranking has a different winner. It is “admin.”

That is the top password for American users in the most recent edition of the annual list from the password manager NordPass, according to Fox News, which published the US top 20. “Password” came second and “123456” third.

The rest of the list

The rest of the US top 10 is what you might expect. After those three come 12345678, 123456789, 12345, Password with a capital P, 12345678910, Gmail.12345 and Password1. Fox reports that variations on the word “password” took five places in the top 20, and number strings took nine.

Some entries try to look stronger than they are. A capital letter at the start, a “1” at the end or a full stop in the middle are exactly the tweaks people expect, so they add little protection.

Where the list comes from

NordPass does not survey people about their passwords. According to its methodology, the company and NordStellar worked with independent cybersecurity researchers to analyze public data breaches and dark web repositories from September 2024 to September 2025. The data was sorted by country across 44 countries. NordPass says no personal data was bought or acquired for the research.

In other words, these are real passwords that have already leaked. Anyone using one of them is relying on a password attackers already have on file.

America keeps changing its favorite

Globally, the picture barely moves. NordPass says “123456” was again the world’s most common password, its sixth win in the seven years the list has run. “Password” took the top spot the one other year.

The US list is less predictable. In 2022, the top American password was “guest,” according to Scripps News, knocking “123456” down from first place the year before.

In 2023, “123456” was back in first place, and in 2024 the winner was “secret.” NordPass’s owner, Nord Security, said in its announcement that the US was the only country where that word ranked first, and that it had not appeared among Americans’ common choices at all the year before. Then in the 2025 edition it gave way to “admin.”

The reports do not explain the swings. Underneath, the same number strings and “password” variants keep showing up year after year.

Young users are no better

The 2025 edition looked at age groups, too. NordPass expected younger users to do better and found they did not: in its words, the habits of an 18-year-old are “strikingly similar to those of an 80-year-old.”

What the official guidance says

These lists matter because attackers start with the most likely guesses. The US government’s digital identity standard, published by the National Institute of Standards and Technology, now requires services that follow it to block them. Under NIST’s guidelines, when someone sets or changes a password, the service must check it against a blocklist of commonly used, expected or compromised passwords, and make the person choose another if it matches. The same guidelines call for passwords used on their own to be at least 15 characters long.

If your password is on the list

The fix is simple. Change it, and use a different password for every account, so one leak cannot open the rest. A password manager can generate and remember long, random passwords for you, and turning on multi-factor authentication or switching to passkeys, where a site offers them, adds a layer that a stolen password alone cannot get past.