We are gathered here today to say goodbye to a legend. Not a good legend, and certainly not a safe one, but a legend nonetheless.
Password123, known to some as password!, P@ssword1, or the season-and-year combination taped to an office monitor, you were the little credential that could. You were easy to remember and easy to type, and you asked almost nothing of us.
You were also, and we say this with love, catastrophically bad at the one job you were given.
A life lived in plain text
You were born from a simple human truth: nobody wants to invent a secure new password at 9 a.m. on a Monday when they’re just trying to open the invoicing system.
You were there when we signed up for software we barely used. You were there when the reset screen demanded a capital letter, a number and a symbol, and we capitalised the first letter and added an exclamation mark. You were there when the Wi-Fi password became the company name followed by the year the business opened.
You judged no one, and attackers loved you for it.
The numbers, since we’re here
The NordPass and NordStellar 2025 common-password report, based on data from public breaches and dark web repositories, put 123456 at the top of the global list again. It has led the report in six of its seven editions, and password is still among the regulars.
Let us also remember a few colleagues who shared your approach to protection:
- 123456: less a lock than a welcome mat.
- qwerty: a keyboard warm-up posing as security.
- password: honest about its purpose, unhelpful in every other way.
- admin: the default that refused to retire.
- CompanyName2026!: dressed up with a symbol, still the same old password.
You were in good company, Password123. Terrible, terrible company.
The five stages of password grief
“Nobody’s going to target me. I run a small business. I’m not interesting.”
“Why do I need a capital letter, a number and a symbol? It’s only a login.”
“What if I add our founding year? That’s basically different.”
A staff member is locked out of an account, nobody knows who controls the recovery email, and the person who set it up left two years ago.
Fine. We’ll use a password manager, turn on multifactor authentication, and stop emailing the same login around the office.
What you leave behind
You leave a complicated legacy, Password123.
There are sticky notes on monitors. There are spreadsheets called Passwords (Do Not Share) that have somehow been shared with the whole team. And in every office there’s one person who has to walk over and type a password in personally because “it’s complicated,” when really it’s just embarrassing.
You also leave a real business risk. Email, billing systems, cloud storage, website accounts and social media pages are all places where one stolen login can cause expensive confusion very quickly.
People choose memorable passwords because they’re human, and blaming them doesn’t help. A business shouldn’t depend on everyone remembering a different, excellent password for every system they use.
What should replace you
The funeral is funny, but the replacement plan should be practical.
CISA recommends that small and medium-sized businesses require strong passwords, use a password manager, and pair passwords with multifactor authentication, since weak or stolen passwords are one of the easiest ways into business accounts.
In practice, that means:
Tools like 1Password, Bitwarden (which has a free plan) or Dashlane create and store a unique password for every account. You remember one master password, and it remembers the rest.
Start with email, cloud storage, billing, banking and your website admin. With MFA on, a stolen password alone isn’t enough to get in.
Where you can give each person their own account, do it. With shared logins, you can’t remove one person’s access without disrupting everyone else.
When someone leaves or changes jobs, update their access right away. Accounts that are never closed are an easy way in.
Where they’re available, passkeys replace the password entirely and resist phishing. CISA recommends phishing-resistant MFA, and passkeys are one way to get there.
You don’t need to do all of this at once. Start with a password manager and MFA on your email account; those two changes deal with most password-related risk for a small business.
Rest in peace, Password123
You were never the whole problem. You were what happened when security got treated as somebody else’s job, or as a box to tick before the real work could start.
For a small business, a safer setup doesn’t need an elaborate security programme. It can start with a password manager, MFA on critical accounts, separate logins for each person, and a clear record of who owns what.
So rest, old friend. The world is slowly moving to passkeys and sign-in methods that don’t ask one easily guessed word to protect a whole business. We’ll think of you fondly, especially on the day somebody suggests using you again.