Most Leaked Passwords

As of 2026-10-07 on Have I Been Pwned, the most leaked password is 123456, seen 210,461,208 times. 123456789 (81.1M) and 12345678 (70.6M) follow, and even tkfkdgo — “I love you” typed on a Korean keyboard — shows up 174,486 times.

Breach counts (checked 2026-10-07)

Rank	Password	Times seen in breaches
1	`123456`	210,461,208
2	`123456789`	81,108,282
3	`12345678`	70,606,130
4	`password`	52,372,427
5	`admin`	42,266,086
6	`12345`	31,107,081
7	`qwerty`	30,812,897
8	`1234567890`	19,826,299
9	`111111`	15,943,793
10	`qwerty123`	13,871,714
11	`abc123`	12,994,280
12	`000000`	12,866,377
13	`password1`	9,643,893
14	`1q2w3e4r`	7,322,046
15	`iloveyou`	7,007,935
16	`1qaz2wsx`	5,832,052
17	`dragon`	4,415,380
18	`zxcvbnm`	4,138,978
19	`a123456`	3,773,237
20	`qwer1234`	3,436,752

Counts from the Have I Been Pwned Pwned Passwords API, queried 2026-10-07. Only well-known common passwords were looked up.

Check my password

Korean-keyboard passwords leak too

Typing Korean on an English keyboard layout turns “사랑해” (I love you) into tkfkdgo. It looks random, but it is already on attackers’ lists.

Password	What it is	Times seen
`tkfkdgo`	“사랑해” (I love you) typed on a Korean keyboard	174,486
`saranghae`	Korean “I love you”, romanized	56,699
`sarang`	Korean “love”, romanized	26,995
`dkssud`	“안녕” (hi) on a Korean keyboard	24,239
`dkssudgktpdy`	“안녕하세요” (hello) on a Korean keyboard	5,194
`wjdgus`	Korean name “정현” on a Korean keyboard	3,425
`gksrmf`	“한글” (Hangul) on a Korean keyboard	1,945
`rhkdwls`	Korean name “광진” on a Korean keyboard	547

If you use a password on this list

Change it everywhere right now. Adding a digit is not enough.
Use 16+ characters made of four or more unrelated words. Check it with the strength checker.
Turn on two-factor authentication so a leaked password alone can’t sign in.

Tools

Play together

Make a group scoreboard

FAQ

What is the most leaked password?

123456, seen 210,461,208 times in Have I Been Pwned’s breached password corpus as of 2026-10-07.

How were these counts looked up?

Through the Have I Been Pwned Pwned Passwords API (k-anonymity range search), for well-known common passwords only — the same method this site’s pwned password check uses.

Are passwords typed on a Korean keyboard safe?

No. tkfkdgo (“I love you”) appears 174,486 times and dkssud (“hi”) 24,239 times. Attacker wordlists include keyboard-layout conversions.

If my password isn’t on this list, is it safe?

This table is only a sample. Check your own password with the breach check and strength test on the home page.