A new study by NordPass reveals that many people are still clinging to passwords they created years ago, with some carrying childhood-era credentials well into their adult lives.
The research, conducted across eight countries (the US, Canada, the UK, Australia, France, Germany, Italy, and Spain), found that just over half (54%) of respondents have updated their longest-standing password within the past year. While around 15% have made a change in the last three years, and 8% did it three to five years ago, a stagnant minority remains: 4% are still using passwords created five to ten years ago, and up to 3% are using legacy credentials that are over a decade old. Most concerningly, around 6% of respondents globally admit they have never changed their oldest password at all.
“It’s a bit ironic: We’ve upgraded our phones and our lives, yet for many, a 15-year-old pet’s name or that ‘Summer2010’ password is still doing the heavy lifting for main email accounts or even retirement funds,” says Karolis Arbaciauskas, head of product at cybersecurity company NordPass and its parent organization Nord Security.
Old passwords rarely age well
In the study, Italy stands out as the country with the highest share of recent password changes (65%) and the lowest number of passwords that have not been changed in over a decade (1%) or at all (4%). Germany sits at the opposite end, with the lowest recent-change rate (47%) and one of the highest proportions of respondents clinging to legacy credentials. At least 3% of Germans are still using passwords older than a decade, while 6% have never updated their oldest password at all.
The US led on a different but equally worrying measure: 14% of respondents said they could not remember the last time they changed their oldest password, the highest rate among all countries surveyed. In most other countries, that figure hovered around 11%.
“I’m fairly certain most internet users know they should immediately change a password that has been compromised. So when people say they haven’t changed a password in years, either the password hasn’t been exposed, or they simply don’t know it has. I hate to be a bearer of bad news, but the second scenario is far more likely. Without tools to notify them when credentials appear in leaks or breaches, many users have passwords aging in the background while the risk grows,” says Arbaciauskas.
A habit that starts young — and sticks
Interestingly, the age-based demographic analysis subverts the usual stereotypes about “digital natives.” Although Gen Z is often presumed to have a good understanding of digital tools — and, by extension, cybersecurity — respondents aged 18-24 are the least likely to have changed their longest-standing password within the past year and the most likely to say they had never changed it at all.
In fact, the password change recency trend goes up with age, peaking with the 55-to-64 age group. Older users, especially Baby Boomers, appear more security-conscious in their maintenance behavior — they update passwords more actively, but are more likely to rely on memory or write passwords down. In other words, they put in the effort without following best practices.
“This study complements our annual Top 200 Passwords research, which found that Gen Z tends to choose simple passwords — often consisting of basic number sequences or internet trends,” says Arbaciauskas. “The high rates of Gen Z-ers saving passwords in browsers, combined with the fact they have the highest ‘never changed’ proportion, reveal that it’s a generation that is comfortable with digital tools but disengaged from basic credential hygiene.”
According to Arbaciauskas, the combination of vulnerable passwords and inconsistent storage habits creates a high-risk target for cybercriminals. Password managers can help bridge these security gaps by offering monitoring tools and real-time alerts whenever credentials appear in a breach.
Methodology
The quantitative research on password habits was conducted by Nord Security between March 26 and April 6, 2026, among 7,861 respondents aged 18-74 in Australia, Canada, France, Germany, Italy, Spain, the UK, and the US.
ABOUT NORDPASS
NordPass is a password manager for both business and consumer clients. It’s powered by the latest technology for the utmost security. Developed with affordability, simplicity, and ease of use in mind, NordPass allows users to access passwords securely on desktops, mobile devices, and browsers. All passwords are encrypted on the device, so only the user can access them. NordPass was created by the experts behind NordVPN — the advanced security and privacy app. For more information: nordpass.com.
Related
This entry was posted on July 7, 2026 at 8:18 am and is filed under Commentary with tags Nordpass. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Guest Post – Child’s play: Many adults guard their online lives with passwords they created as kids, study finds
A new study by NordPass reveals that many people are still clinging to passwords they created years ago, with some carrying childhood-era credentials well into their adult lives.
The research, conducted across eight countries (the US, Canada, the UK, Australia, France, Germany, Italy, and Spain), found that just over half (54%) of respondents have updated their longest-standing password within the past year. While around 15% have made a change in the last three years, and 8% did it three to five years ago, a stagnant minority remains: 4% are still using passwords created five to ten years ago, and up to 3% are using legacy credentials that are over a decade old. Most concerningly, around 6% of respondents globally admit they have never changed their oldest password at all.
“It’s a bit ironic: We’ve upgraded our phones and our lives, yet for many, a 15-year-old pet’s name or that ‘Summer2010’ password is still doing the heavy lifting for main email accounts or even retirement funds,” says Karolis Arbaciauskas, head of product at cybersecurity company NordPass and its parent organization Nord Security.
Old passwords rarely age well
In the study, Italy stands out as the country with the highest share of recent password changes (65%) and the lowest number of passwords that have not been changed in over a decade (1%) or at all (4%). Germany sits at the opposite end, with the lowest recent-change rate (47%) and one of the highest proportions of respondents clinging to legacy credentials. At least 3% of Germans are still using passwords older than a decade, while 6% have never updated their oldest password at all.
The US led on a different but equally worrying measure: 14% of respondents said they could not remember the last time they changed their oldest password, the highest rate among all countries surveyed. In most other countries, that figure hovered around 11%.
“I’m fairly certain most internet users know they should immediately change a password that has been compromised. So when people say they haven’t changed a password in years, either the password hasn’t been exposed, or they simply don’t know it has. I hate to be a bearer of bad news, but the second scenario is far more likely. Without tools to notify them when credentials appear in leaks or breaches, many users have passwords aging in the background while the risk grows,” says Arbaciauskas.
A habit that starts young — and sticks
Interestingly, the age-based demographic analysis subverts the usual stereotypes about “digital natives.” Although Gen Z is often presumed to have a good understanding of digital tools — and, by extension, cybersecurity — respondents aged 18-24 are the least likely to have changed their longest-standing password within the past year and the most likely to say they had never changed it at all.
In fact, the password change recency trend goes up with age, peaking with the 55-to-64 age group. Older users, especially Baby Boomers, appear more security-conscious in their maintenance behavior — they update passwords more actively, but are more likely to rely on memory or write passwords down. In other words, they put in the effort without following best practices.
“This study complements our annual Top 200 Passwords research, which found that Gen Z tends to choose simple passwords — often consisting of basic number sequences or internet trends,” says Arbaciauskas. “The high rates of Gen Z-ers saving passwords in browsers, combined with the fact they have the highest ‘never changed’ proportion, reveal that it’s a generation that is comfortable with digital tools but disengaged from basic credential hygiene.”
According to Arbaciauskas, the combination of vulnerable passwords and inconsistent storage habits creates a high-risk target for cybercriminals. Password managers can help bridge these security gaps by offering monitoring tools and real-time alerts whenever credentials appear in a breach.
Methodology
The quantitative research on password habits was conducted by Nord Security between March 26 and April 6, 2026, among 7,861 respondents aged 18-74 in Australia, Canada, France, Germany, Italy, Spain, the UK, and the US.
ABOUT NORDPASS
NordPass is a password manager for both business and consumer clients. It’s powered by the latest technology for the utmost security. Developed with affordability, simplicity, and ease of use in mind, NordPass allows users to access passwords securely on desktops, mobile devices, and browsers. All passwords are encrypted on the device, so only the user can access them. NordPass was created by the experts behind NordVPN — the advanced security and privacy app. For more information: nordpass.com.
Share this:
Like this:
Related
This entry was posted on July 7, 2026 at 8:18 am and is filed under Commentary with tags Nordpass. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.