Yuka KatoIn a world where over 2,200 cyberattacks are made per day, passwords are an internet user’s baseline defense against digital ne’er-do-wells. But when the average person has to remember 168 of them for their myriad online accounts, it’s easy to see how password fatigue can set in.
Unfortunately, hackers are all too aware of humanity’s reliance on unsafe password practices in an attempt to make logging in easier. For instance, one in four people reuse the same password across more than eleven sites and apps, meaning a hacker gaining access to one account can quickly gain access to the rest in a domino effect. Meanwhile, over a third of people include personal information in their passwords, so all a hacker needs to do to crack the code is scour social media feeds for clues.
The good news is that more and more websites are compelling users to create passwords with secure attributes like mixed-case letters, numbers and special characters — but have you ever wondered which passwords are the most dangerous to still be using today? By analyzing the pop culture passwords most exposed in data breaches, we searched for answers.
What We Did
Data analysts at Mailsuite built a list of over 2,612 pop culture terms and 63,849 variations thereof in capitalization, punctuation and spacing. We then cross-referenced them against the Pwned Passwords database (which details over 300 million passwords exposed in known data breaches) and ranked the passwords within each pop culture category (e.g., music, video games, sports) by their number of appearances in data breaches, i.e., the higher the number of appearances, the more dangerous the password.
Key Findings
- Superman is the most dangerous word from pop culture to use as a password, having appeared in 584,697 data breaches.
- Eminem is the most dangerous word in music to use as a password, having appeared in 286,263 data breaches.
- Zac Efron is the most dangerous actor’s name to use as a password (24,268 appearances in data breaches).
- The most dangerous password to use based on video games is Minecraft, which has appeared in 215,934 data breaches.
Superman Is the Most Dangerous Pop Culture Word to Use as a Password
If you’re using the word Superman as a password for anything, better change it now: it’s the most dangerous pop culture password to use, having appeared in 584,697 data breaches (more than any other word or phrase in our analysis). As the name of America’s favorite superhero, it’s no surprise that people might choose this memorable moniker as a password, but it takes less than a second for hackers to crack.
The next most dangerous password is Blink-182, which has popped up 482,244 times in data breaches. Using this particular band’s name as a password is probably popular among Gen X and Millennial internet users, who incidentally are the two most likely generations to change their password at least once a year. Cybersecurity experts advise changing passwords every three months.
Eminem Is the Most Dangerous Password from the World of Music
Having a famous musician’s name as your password is easy to remember, but it’s also a surefire way to leave your accounts vulnerable to hacking. Eminem is the most dangerous musician’s name to use as a password, having appeared 286,263 times in data breaches. Counting only six characters, the rapper’s moniker will take mere seconds to crack as a password.
Fellow rapper 50 Cent’s name is the next most dangerous password to use (267,691 appearances in data breaches). Password setters might be using his name (spelled this way) in the belief that the combination of numbers, mixed-case letters and punctuation (a space) makes it safer to use, but Bitwarden estimates that it would take just 17 minutes to crack. Shakira comes in third place (57,848 appearances).
Blink-182 Is the Most Vulnerable Rock Band Password to Hacker Attacks
Rock is one of the most popular types of music in the U.S., so it’s no wonder many people use the name of their favorite rock band as a memorable password — but don’t make the same mistake. The most dangerous rock band name to use as a password is the aforementioned Blink-182 (482,244 appearances in data breaches), followed by Metallica (264,913 appearances).
At nine characters long, with a capital at the beginning, users might think that the word Metallica is safe; in reality, the band’s name takes less than a second to crack. Generally, the longer a password, the longer it takes a hacker to crack. At 11 characters each, Linkin Park and Iron Maiden are the longest rock band names on the list — but they’ve still been found in tens of thousands of data breaches.
Zac Efron Leads as the Most Dangerous Actor’s Name Password
It might be tempting to use the name of your favorite actor as a password, but it’s not a good idea. Our analysis reveals that Zac Efron is the most dangerous option: his name has appeared in 24,268 data breaches (the most of any actor’s name), and cracking this password would take half a day. After that comes Brad Pitt, a password that has popped up 18,152 times in data breaches.
A-list actors are often the target of email hacks. This is a good reminder for anyone to make sure they send sensitive emails securely. On Gmail, you can do this by clicking on the padlock icon at the bottom of an email draft and toggling on confidential mode. On Outlook, you’ll have to tinker with your account’s Trust Center or Security settings to do so (Microsoft has a detailed guide on what to do).
Batman and Star Wars among the Worst Media Franchise Passwords to Use
Other internet users borrow the titles of specific media franchises for their passwords. The most dangerous of them all is the aforementioned Superman, followed by fellow DC Comics superhero Batman (352,422 data breaches), a word that would take a hacker less than a second to crack. After that comes Star Wars (323,546 appearances in data breaches).
Also making the ranking is Barbie (186,730 appearances in data breaches), the star of the eponymous smash-hit film of 2023. “Unfortunately, what is trending worldwide in the movie scene is often trending in our passwords,” commented NordPass’s Gediminas Brencius on the trend of pop culture influencing our password habits. “The same logic applies to sports, music, food, and other things people enjoy. Our passwords are predictable, which is the best gift for hackers.”
Minecraft is the Most Dangerous Password to Use on the Theme of Gaming
Some of the biggest data breaches in recent history have involved video game networks. The 2011 attack on the PlayStation Network, for example, compromised 77 million user accounts. In the world of gaming, Minecraft ranks as the most dangerous password to use, having appeared in 215,934 data breaches. Bitwarden estimates that this password would take less than a second to crack.
Also on the list is Left 4 Dead (29,573 appearances in data breaches), which — if written with the same capitalization, punctuation and numbers as the actual franchise title — takes a bit longer for hackers to crack (one day). Meanwhile, other users might select the name of a particular video game character to use as a password. The most dangerous of these are ranked below.
Pikachu — the lovable star of the Pokémon series — takes the crown, having appeared in 96,430 data breaches. After that comes Mario (57,471 appearances) and Mega Man (55,183 appearances).
New York Yankees Leads as the Worst Sports-Themed Password to Use
One in three Americans have used a sports-themed password at some point, but which is the most dangerous to use? Sorry, fans of the New York Yankees — we’re calling time on your password, as this team’s name has appeared in more data breaches (170,241) than any sports-themed password. In second place comes the Boston Red Sox (116,987 appearances in data breaches).
Two individuals in the sporting world also make the ranking: wrestler John Cena (78,156 appearances in data breaches) and golfer Tiger Woods (14,584 appearances).
Five Tips for Creating a Secure Password
If any of your current passwords have popped up in our analysis, it’s time to change them. Use our five tips below to create a super-secure password that will stop hackers in their tracks.
1. Make it at least 14 characters long
Most hacking attempts are ‘brute force’ attacks, meaning the hacking software uses a trial-and-error method of guessing a password by working through trillions of combinations of characters. Therefore, the longer your password is in length, the more possible permutations it has and the longer it takes for a hacker to crack it. But there’s a catch…
2. Use a combination of different characters
A 14-character password that is just a string of numbers could take a hacker less than an hour to crack. That’s why it’s essential to use a combination of upper- and lowercase letters, numbers and special characters (like * or &); going through all the possible permutations of a 14-character password like that would take a hacker 200 million years.
3. Don’t use a date as a password
You shouldn’t use a numerical date (like a birthday or your wedding anniversary) as a password for two reasons. The first is that — assuming you’ve used a string of numbers in the MMDDYYYY format — you’ve got a relatively short password that consists of only numbers. That’s a password that can be cracked instantly. The second reason is that a date that’s on social media could be easily found by hackers and tried out in combination with your username or email address.
4. Don’t use any personal information in a password
As above, sometimes a hacker is someone who has seen your social media and made note of the name of any pets you may have, loved ones or your favorite baseball team. With your username and email address in hand, they could then try these words out in an attempt to get into your account.
5. Don’t use a word you can find in the dictionary
One in five people across the world use the word ‘password’ as a password. Don’t be like them — a password you can find in the dictionary is vulnerable to a type of hacking attempt called a ‘dictionary attack,’ where the hacking software tries out different words and phrases to guess your password.
Once you’ve made a secure password using our tips above, make sure to keep it to yourself, never writing it down or sharing it with anyone. Cybersecurity experts say you should change your passwords every three months, so be sure to make a note in your diary so it becomes a regular occurrence. The last thing to remember is to make sure to vary your passwords across all your online accounts — if a hacker gains access to one, they could try the same password out on different accounts you own.
Email Security Starts With Your Password
Keeping your email address safe starts with the creation of a strong password, but it doesn’t stop there. Beware of strange emails from unknown senders, and never download attachments from suspicious messages. In this day and age, it is paramount that you also enable two-factor authentication, as it will give your email account an added layer of protection.
If you’re used to emailing sensitive documents, don’t forget to apply our tips above to create a secure password to protect email attachments.
Methodology
Our first step was to build a seed list of over 2,612 pop culture terms with a total of 63,849 variations (i.e., different capitalization, punctuation, spacing), covering everything from personalities and bands to video games and media franchises.
We then cross-referenced these against the Pwned Passwords database, which contains over 300 million passwords that were exposed in known data breaches.
This allowed us to rank these pop culture-inspired passwords based on the total number of appearances in data breaches, as reported by Pwned.
Notes:
- Passwords that were exposed should be updated immediately and avoided in the future, as they’re at much greater risk of being used by bad actors who want to hack into accounts.
- The data was collected and analyzed in March 2024.
