Cybersecurity experts say more complex passwords are needed as ‘123456’ tops most popular list again

It’s World Password Day, a day dedicated to getting people to use stronger passwords to help Canadians avoid having their accounts hacked.

While cybersecurity experts advise to use complex passwords for accounts, it appears some Canadians are still using simple passwords with the most common ones still being “123456” and “password” in 2025, according to a report.

According to Cybernews, other commonly used passwords this year also include “qwerty”, “111111” and “qwerty123.”

While many people make an effort to use strong passwords for banking and credit cards, some may reuse simple passwords for other services.

“Use long, strong, unique passwords for every place you go to, and don’t reuse those passwords,” said Jane Arnett, a cybersecurity expert for Check Point Canada.

It’s also possible criminals may already have passwords you’re reusing from previous hacks.

“If you are reusing passwords in that way, you should assume they will be compromised and it’s a good idea to change them as soon as you can,” Stephen McDermid, a security expert with Okta, told CTV News Toronto.

McDermid suggests using layers of security for your accounts, like two-factor authentication, and to consider upgrading a password manager or passkeys, which can replace traditional passwords.

“There is definitely a role to play for password managers and passkeys and password creators, as they will allow you to create random passwords easily,” said McDermid.

The password to your email should also have a strong password because if criminals can hack it, they could request password resets for all of your services and have those resets sent directly to them without your knowledge.

“For me, that’s the most important password. It’s typed in every time and it’s very long and very strong,” said Arnett.

Biometrics, such as face recognition and fingerprints, may one day replace passwords, but until they do, it is encouraged to try to create complex passwords.

With so many different services requiring passwords, if people use or recycle old passwords for them, criminals can figure out the pattern and hack into the account.

“We have an average of 50 reports a day,” TPS Det. David Coffey told CTV News Toronto.

Already this year, police say Torontonians have lost $168 million to various types of fraud, with many crimes starting with identity theft.

“Identity theft is the root of all fraud—of all evil—and it’s hard to narrow down the damage caused by identity theft because you never know when identity theft will be used and for what purpose,” said Coffey.