ARLINGTON, VA — Releasing its annual findings in a windowless conference room at 9:04 a.m. Thursday, after what attendees described as a long pause and a longer exhale, the Coalition of Unauthorized Access Professionals confirmed that “Password123” remains the most popular password in America, and that its members are “frankly tired.”
“Every year we put out the report, and every year we hope,” said coalition spokesman Gary Ostrowski, 47, a 22-year veteran of the industry, before letting out a sigh that the room’s audio technician logged at 61 decibels, roughly the volume of a normal conversation, or of a man who has just gotten into a regional hospital’s billing system on the first try. “Then we type ‘Password123,’ and we’re in. Again. I have a graduate degree.”
The report, titled State of the Credential 2026: Please, found that Password123 has held the top spot among accounts protected by complexity rules for the ninth straight year. Coalition analysts credited the password’s success to corporate policies that demand at least one capital letter and one number, which members said turn the word “password” into “Password123” with what Ostrowski called “the reliability of a sunrise.”
The findings track closely with outside research. A NordPass study of passwords exposed in breaches over the past year found “123456” at the top of the global list for the sixth time in seven years, while “admin” ranked first in the United States, a result coalition members described as “a cry for help from the IT department.” Of the 200 most common passwords in that study, 32 contained symbols, mostly in arrangements like “P@ssw0rd” and “Admin@123.”
“People think the @ sign slows us down,” said Tamsin Reyes, 24, a junior intrusion specialist who chose the field because she “wanted a challenge.” “It’s the first thing we try. It’s the first thing everyone tries. The @ is just the password saying ‘please.’”
🧑💻 The Hacker-Grade Strength Meter
Ordinary strength meters tell you whether a password is weak. Ours tells you how disappointed a professional would be. Type something made up, or tap a sample. Please do not type a real password: this meter runs in your browser and sends nothing anywhere, but that is exactly what you would say about your router, too.
Scoring follows the rules of thumb coalition members actually use: length beats symbols, common words with numbers bolted on fall first, and anything that has appeared on a famous list is on every list. The coalition recommends a password manager or a passkey, and has asked that it be noted how much it hates recommending this.
Members said the persistence of easy passwords has had a corrosive effect on morale. According to Verizon’s 2025 Data Breach Investigations Report, the use of compromised credentials was the way in for 22 percent of the breaches it reviewed, a figure Ostrowski called “the most humiliating statistic in my profession.”
“Twenty-two percent of the time, we walked in the front door with the key,” he said. “Nobody makes a heist movie about that. Nobody makes a heist movie about a guy typing ‘Summer2026!’ and getting it right.”
The coalition singled out, as the low point of its year, a French audit reported by the newspaper Libération, which found that the password to the Louvre’s video-surveillance server had at one point been “LOUVRE.” Another security system was reportedly protected by “THALES,” the name of the company that made it. “That isn’t a password. That’s a label,” Reyes said. “It’s like writing ‘SAFE’ on a safe. The Mona Lisa deserved better. Honestly, we deserved better.”
Training has suffered too. The coalition’s apprenticeship program once spent six weeks on brute-force techniques. Instructors said that curriculum has now been compressed to a single slide reading “Try The Obvious Thing,” followed by 11 weeks the syllabus calls “Managing Feelings Of Being Overqualified.” Ostrowski keeps the password-cracking rig he built in 2011 in his garage, where it has not been switched on since 2019. “My daughter asked what it does,” he said. “I told her it used to matter.”
Federal standards officials have tried to help. In July 2025, the National Institute of Standards and Technology finalized revised guidance telling organizations to stop forcing scheduled password changes and stop demanding special characters, and to instead screen new passwords against lists of known compromised ones and allow long passphrases. The coalition said it “strongly supports” the guidance and has sent NIST a fruit basket.
“Forced rotation gave us Password123, then Password124, then Password125,” Ostrowski said. “You don’t have to be a hacker to see that. You just have to be awake.”
Most employers, members said, have not read it. “They read the 2003 version, laminated it and hung it in the break room,” Reyes said. “Right next to the sticky note with the Wi-Fi password.”
🔑 Guess The Password: A Coalition Entrance Exam
Think you have what it takes to join the nation’s most bored profession? Each target below is protected by one of four passwords. Pick the one you think is real. All institutions are invented except the museum, which unfortunately is not.
The sigh is synthesized in your browser from filtered noise and is not the actual sigh of any actual hacker. It plays only when you press the button. Keep your volume reasonable; Gary’s is not.
Asked about passkeys, which let people sign in with a fingerprint or a face instead of a typed secret, Ostrowski grew quiet. Surveys by the FIDO Alliance, the industry group behind passkeys, have found a growing share of consumers switching them on whenever a site offers.
“That’s the first good news we’ve had in a decade,” he said, then corrected himself. “Bad news. For us. I meant bad news. I don’t know why I said good.” He then sighed for 11 seconds, a coalition record.
Not every member is discouraged. A faction calling itself the Effort Caucus has proposed a voluntary code of conduct under which members would refuse to log in with any password shorter than eight characters “out of professional dignity.” The measure failed after members realized it would leave them nothing to do on Mondays.
The coalition closed its presentation with a public-service announcement urging Americans to use a password manager, turn on two-factor authentication and choose long passphrases nobody has typed before. Officials acknowledged the advice ran against their own financial interest.
“We just want to feel something,” Ostrowski said. “Make us earn it. Make us work one weekend. That’s all we ask.”
At press time, the coalition’s internal file server, protected by the password “Coalition2026!”, had been accessed by an intern.
Reader Comments (123)