The IT Nerd

More than 3 million email addresses found in data stolen by infostealers over the past year are no longer used by their owners. Some of them are abandoned but still active and pose a security risk. Millions more zombie accounts lurk on once-popular services like Groupon, dating apps people have ghosted, fitness services users gave up on, social media platforms, online shops, and even outdated work tools.

Key findings:

• One year’s harvest. NordPass’ study examined 66.5 million unique email addresses harvested by infostealer malware over the past year and checked whether each address’s domain could still receive emails by checking publicly available DNS records.
• Dangerous impersonators. The most concerning finding involves misspelled versions of major email providers. About 1% of all stolen addresses (664,000) are registered on live look-alike domains like “gamil.com.” Researchers add that some of those credentials may have been harvested when the person simply wanted to access their existing account — for example, on gmail.com — but accidentally typed “gnail.com” and logged in there. These domains work and receive emails. They’re just owned by someone else. In total, the researchers found more than 2,500 such look-alike domains mimicking Gmail, Hotmail, Outlook, Yahoo, and iCloud.
• The dead can rise. Another 4% — 2.6 million addresses — are dead. The domains have expired, reject incoming emails, or never existed. But expired domains can be bought and re-registered by anyone, giving the new owner control over every account still linked to those addresses.
• The harmless dead. The research also found that nearly one in 14 leaked credentials (7%, or 4.7 million addresses) come from throwaway inboxes, while another 2.1% use disposable email services like YOPmail or Mailinator. Both were built to be abandoned.

The issue extends well beyond email. A March 2025 Secure Data Recovery survey found that up to 40% of users hadn’t logged in to accounts on services like Pandora and Groupon for over a year. For many other services named in the survey, including Dropbox, Tumblr, Duolingo, Kickstarter, and Tinder, more than 30% of respondents admitted they had an account they hadn’t signed in to for at least 12 months.

Made for harvesting data

“Accounts created on look-alike domains are probably the most dangerous because those websites are essentially built to steal credentials — cybercriminals actively buy up common misspellings of famous brand names and expired domains to inherit their traffic and reputation, then use them for credential harvesting and intercepting emails intended for the original owner. After entering their details on such a fake page, users are typically shown an error or redirected to the real site — none the wiser. But their account data stays with the attacker,” says Karolis Arbaciauskas, head of product at NordPass and its parent organization Nord Security.

Other deserted accounts — on dating apps, photo services, and online shops, including AliExpress, Shein, and Temu — are also a security risk. The data shows that in the last couple of years, Western shoppers, including Americans, have been leaving Chinese retail marketplaces, but the number of accounts that were just abandoned and not properly deleted remains unknown.

“These zombie accounts stay online with your email address and password attached, and threat actors treat them as an easy source of data. Many are missing security updates and have no two-factor authentication, so attackers can break in with simple password-spraying attacks, testing a handful of common passwords across thousands of accounts. And since most of those abandoned accounts are linked to the owner’s main email address, the stakes are high,” says Arbačiauskas.

Most people reuse passwords or choose easy-to-guess combinations, so a compromised main email address can cascade into total account takeover. “If attackers get into your main email account, they can lock you out of everything else, steal your identity, drain your bank account, or hold your data for ransom,” says Arbačiauskas.

How to stay safe:

• Delete unused accounts. To reduce the risk, review the services you’ve signed up for and delete your account if you no longer use the app, service, or platform.
• Update the recovery email address. Check whether your old email addresses still exist and update the recovery email address on accounts that matter.
• Never reuse passwords. Create strong, unique passwords for every account — a password manager can help you keep track of them. Otherwise, if one account gets broken into, all others are also at risk.
• Use MFA. Whenever possible, enable multi-factor authentication for additional protection.

NordPass is launching Identity Masking and ID Monitoring features to strengthen user identity protection.

Identity Masking, available for Premium, Family, and Business users, allows individuals to generate synthetic personal details for low-trust or unverified websites, protecting true identities from data harvesting and potential breaches.

Forced oversharing

Identity Masking enables users to generate coherent and usable synthetic names, home addresses, and email addresses (powered by Email Masking). These details can be used for newsletters, loyalty programs, and apps that demand extensive personal information without needing to verify a user’s actual identity.

Both Premium and Business users can create identity masks using the NordPass browser extension, desktop, and mobile apps. They can select to create either a male or a female name and pick from one of 12 locations for the address, including the UK, Australia, Brazil, Canada, and Switzerland. The information will look coherent enough to appear real, but will be deliberately engineered to prevent instances of impersonation.

The feature also offers a vital security layer for organizations. Employees often need to access third-party tools or free trials for work, which frequently require personal details. If this data is compromised, it can expose the employer. Identity Masking allows teams to test products and access resources securely while keeping their professional identities private.

Data Breach Scanner upgrade

NordPass also upgraded one of its trademark features, which users have already come to rely on — the Data Breach Scanner. From now on, Premium and Family users will be able to actively monitor not only their credentials, but also their most sensitive personal identification numbers, including SSNs, passports, and national ID cards.

If you think seduction as a tool for data gathering belongs solely in James Bond movies, think again. Cybercriminals are actively using flirtation and romance as attack vectors.

The FBI recently issued a public warning: Scammers are hijacking accounts to steal intimate content and sell it on criminal marketplaces or to blackmail victims, both adults and minors. The perpetrators pose as romantic interests to manipulate targets into revealing credentials, clicking malicious links, or sharing sensitive material.

A calculated emotional investment

“For an attacker, technical breaches are usually costly. Emotional ones are nearly free — they require only patience. Instead of investing in tools and code, criminals spend a week or two on conversations and compliments, creating the illusion of mutual understanding. When the trust or attraction is established, things can quickly go downhill,” says Deividas Ambrazevicius, an engineering manager at NordPass.

Ambrazevicius shared the story of a man who recently met a woman on vacation. They had a great time, and by day four, he received a link with a note: “Here’s our photo album, just for you.” Ten minutes later, his own personal photos, videos, sensitive files, and everything from active login sessions to internal documents were in someone else’s hands. No password was stolen — trust was. The victim clicked on the alleged link to a photo album and installed the malware himself, blindsided by emotions and a vacation romance.

Common romantic attack vectors include:

• Flirtation as an opener. Emotional closeness dulls critical thinking. A link from a romantic interest gets scrutinized far less than one from your bank.
• Fake relationships. Long-term emotional investment makes a single request — for money, photos, or credentials — feel natural.

“The weakest link isn’t the password — it’s the desire to be noticed. It’s also a risk for organizations. They must train employees to recognize emotional manipulation, not just fake banking emails. A romantic scam targeting an employee can become a gateway into corporate infrastructure. The most sophisticated firewall won’t help if an employee hands over credentials to someone they trust because of an emotional attachment,” says Ambrazevicius.

The security industry keeps raising the bar on authentication, yet the weakest link is still the human — and with ClickFix attacks, hackers have found a way to make people hack themselves.

ClickFix is a social engineering attack where the victim is tricked into running malicious code on their own machine, thus giving the threat actor access to everything, including their saved passwords, passkeys, and session cookies.

A real case study

“Someone recently contacted me with a simple question: ‘Is my computer infected?’ For the record, he’s not a NordPass user — he found me through my personal website. He’d come across a LinkedIn post about ClickFix attacks and realized that, just a week earlier, he’d probably fallen victim to one himself. He was right. His story is worth telling — because everything about it looks harmless until the very last second,” says Deividas Ambrazevicius, an engineering manager at NordPass.

The man asking for help was chatting with a former colleague about a week earlier — a real person he knew, with years of message history between them. Or so he thought. This “former colleague” proposed a call, claiming he wanted to talk about work. However, the call failed — no audio — so he said that Microsoft Teams probably needed an update and sent a tidy set of instructions. Where to go, what to copy, where to paste — all neatly prepared. The man followed every step. Then “the colleague” disappeared. And a week later, doubts set in. 

Ambrazevicius suggested reaching out to the person in question through another channel — such as LinkedIn. And sure enough, the colleague knew nothing about any of it. His account had been hijacked. 

“I extracted the relevant data from the computer and ran a forensic analysis. What I found included both the malicious traces and pieces of the story of how the attack unfolded,” says Ambrazevicius.

• The code was obfuscated at the individual character level, so a simple text search would not find it. 
• It was launched using Invoke-Expression, without ever saving an executable file to the disk. That’s why the traditional antivirus software didn’t react. 
• Curl.exe sent the data out over port 443 to a remote command-and-control server (C2). 
• All session cookies saved in the Chrome browser were exfiltrated, along with files belonging to several different companies. 
• The standard Windows firewall allows all outbound traffic without any warning by default — so the attack went unnoticed in real time.

He adds that after a week far less data remained than there could have been. The best course of action, according to the expert, would have been to immediately disconnect from the internet, but not shut down the computer so the RAM wouldn’t get wiped — that’s how most of the picture gets recovered.

Fake CAPTCHA 

According to Ambrazevicius, this was quite a sophisticated attack, involving a hijacked account and a degree of prior preparation. But there are simpler attacks. One of them is fake CAPTCHA — one of the most common ways a ClickFix attack is delivered.

Instead of asking the user to solve an image puzzle, the fake CAPTCHA claims that additional verification steps are required and instructs the user to press a quick sequence of keys. Frequently, that’s Windows Key + R (which opens the Windows native “Run” dialog box), then Ctrl + V (which pastes the hidden malicious payload from the clipboard), and then “Enter” (which executes the command).

“Don’t forget that infostealers don’t just steal passwords — they steal session cookies, the key a server issues after a successful login with 2FA. The criminal loads it into their own browser and opens the account — no password, no code needed. That’s why changing your password after an incident isn’t enough. You need to forcibly terminate all sessions,” Ambrazevicius cautions. 

How to avoid falling victim

• If someone tells you that you need to update an app because they can’t hear you — that’s a red flag. Contact the person through a different channel. 
• Be extremely cautious if a website or program unexpectedly asks you to paste text or run commands in PowerShell or Terminal.
• A familiar name does not equal a familiar person. Accounts get stolen every day. 
• These days, even if you see or hear someone you know, there’s no guarantee it’s really them — it might be a deepfake. Always exercise caution and agree on a code word that only your family and friends know — and ask for it if things feel suspicious.
• If you work with sensitive data and suspect such an incident, do not delay — contact a professional. A computer can reveal a great deal, but only until the user unwittingly destroys the evidence.
• If something like this happens and the sessions and files on your machine are confidential, they must be treated as compromised.

ABOUT NORDPASS

NordPass is a password manager for both business and consumer clients. It’s powered by the latest technology for the utmost security. Developed with affordability, simplicity, and ease of use in mind, NordPass allows users to access passwords securely on desktops, mobile devices, and browsers. All passwords are encrypted on the device, so only the user can access them. NordPass was created by the experts behind NordVPN — the advanced security and privacy app. For more information: nordpass.com.

A new study by NordPass reveals that many people are still clinging to passwords they created years ago, with some carrying childhood-era credentials well into their adult lives.

The research, conducted across eight countries (the US, Canada, the UK, Australia, France, Germany, Italy, and Spain), found that just over half (54%) of respondents have updated their longest-standing password within the past year. While around 15% have made a change in the last three years, and 8% did it three to five years ago, a stagnant minority remains: 4% are still using passwords created five to ten years ago, and up to 3% are using legacy credentials that are over a decade old. Most concerningly, around 6% of respondents globally admit they have never changed their oldest password at all.

“It’s a bit ironic: We’ve upgraded our phones and our lives, yet for many, a 15-year-old pet’s name or that ‘Summer2010’ password is still doing the heavy lifting for main email accounts or even retirement funds,” says Karolis Arbaciauskas, head of product at cybersecurity company NordPass and its parent organization Nord Security.

Old passwords rarely age well

In the study, Italy stands out as the country with the highest share of recent password changes (65%) and the lowest number of passwords that have not been changed in over a decade (1%) or at all (4%). Germany sits at the opposite end, with the lowest recent-change rate (47%) and one of the highest proportions of respondents clinging to legacy credentials. At least 3% of Germans are still using passwords older than a decade, while 6% have never updated their oldest password at all.

The US led on a different but equally worrying measure: 14% of respondents said they could not remember the last time they changed their oldest password, the highest rate among all countries surveyed. In most other countries, that figure hovered around 11%.

“I’m fairly certain most internet users know they should immediately change a password that has been compromised. So when people say they haven’t changed a password in years, either the password hasn’t been exposed, or they simply don’t know it has. I hate to be a bearer of bad news, but the second scenario is far more likely. Without tools to notify them when credentials appear in leaks or breaches, many users have passwords aging in the background while the risk grows,” says Arbaciauskas.

A habit that starts young — and sticks

Interestingly, the age-based demographic analysis subverts the usual stereotypes about “digital natives.” Although Gen Z is often presumed to have a good understanding of digital tools — and, by extension, cybersecurity — respondents aged 18-24 are the least likely to have changed their longest-standing password within the past year and the most likely to say they had never changed it at all.

In fact, the password change recency trend goes up with age, peaking with the 55-to-64 age group. Older users, especially Baby Boomers, appear more security-conscious in their maintenance behavior — they update passwords more actively, but are more likely to rely on memory or write passwords down. In other words, they put in the effort without following best practices.

“This study complements our annual Top 200 Passwords research, which found that Gen Z tends to choose simple passwords — often consisting of basic number sequences or internet trends,” says Arbaciauskas. “The high rates of Gen Z-ers saving passwords in browsers, combined with the fact they have the highest ‘never changed’ proportion, reveal that it’s a generation that is comfortable with digital tools but disengaged from basic credential hygiene.”

According to Arbaciauskas, the combination of vulnerable passwords and inconsistent storage habits creates a high-risk target for cybercriminals. Password managers can help bridge these security gaps by offering monitoring tools and real-time alerts whenever credentials appear in a breach.

Methodology

The quantitative research on password habits was conducted by Nord Security between March 26 and April 6, 2026, among 7,861 respondents aged 18-74 in Australia, Canada, France, Germany, Italy, Spain, the UK, and the US.

ABOUT NORDPASS

NordPass is a password manager for both business and consumer clients. It’s powered by the latest technology for the utmost security. Developed with affordability, simplicity, and ease of use in mind, NordPass allows users to access passwords securely on desktops, mobile devices, and browsers. All passwords are encrypted on the device, so only the user can access them. NordPass was created by the experts behind NordVPN — the advanced security and privacy app. For more information: nordpass.com.

A new study by NordPass reveals that most users store their passwords in their web browser, prioritizing ease of use over digital safety. Because browser-based credentials are often tethered to a user’s primary account, a single breach can leave an entire digital life exposed.

To understand password storage habits, researchers surveyed consumers in eight countries: the US, Canada, the UK, Australia, France, Germany, Italy, and Spain. The study found that browser-based saving is the default choice for the vast majority (around 40-50%) of respondents, effectively creating a single point of failure. When this habit is paired with password reuse, it creates a digital house of cards that collapses if just one account is breached.

“Convenience and ease of use dominate as the top two drivers, confirming that browser password saving is overwhelmingly a comfort-driven behavior — with cost and passive auto-save prompts playing a secondary but consistent role,” says Karolis Arbaciauskas, head of product at NordPass and its parent organisation, Nord Security.

Canadians lean on a deceptively risky habit

According to the survey, Canadians are the second most likely to combine browser-based and third-party password managers. As many as 16% of Canadian respondents use this hybrid approach — behind only the US (18%). Meanwhile, 37% save their passwords exclusively in their browser, and only 13% rely on a dedicated password manager alone.

In fact, more Canadians use a combined approach than a dedicated manager on its own — a pattern shared with the US, Australia, and the UK, but reversed across most EU countries.

“Combining a browser-based password manager with a third-party tool is incorrectly assumed to be a safe way to maintain a backup. However, if the passwords stored in the browser are compromised, the backup does little to protect them. Password reuse only sharpens this problem,” says Arbaciauskas.

Distinct habits around the world

Canadians are far from alone in their reliance on browsers to save their passwords, but habits vary widely across the eight countries surveyed. Spanish users are the most security conscious. Nearly one in five (19%) respondents from Spain stated that they use a dedicated password manager. In contrast, only 8% of Italians use such a tool.

German users are the most tool-averse in general, with the highest share (22%) relying purely on memory. France stands out for its love of the analogue. As many as 13% of French respondents still write their passwords down on paper.

According to Arbaciauskas, the habit of memorizing passwords — prevalent in Germany, Australia, Canada, and the UK — often leads to the reuse of identical or very similar credentials (such as swapping only a single letter or number). These memory-friendly passwords are far easier to breach, potentially triggering a chain reaction where a single leak compromises most, if not all, of a user’s accounts.

Convenience comes at the cost of risk

Convenience comes at a steep price. Browser-based managers are usually tethered to the user’s primary account (e.g., Google, Microsoft, etc.). If a hacker compromises that single account, they don’t just get your emails — they get the jackpot of every credential stored in that browser.

“Browser-based password managers are certainly a better choice than simply reusing or slightly altering the same password everywhere. However, dedicated password managers offer distinct advantages, such as encryption based on zero-knowledge architecture. This means all data is encrypted on your device before it ever leaves your computer or smartphone, ensuring that not even the developers can access your passwords — let alone anyone else,” says Arbaciauskas.

Unlike browser-based password managers, dedicated tools are not tied to any ecosystem and work seamlessly across all major browsers and operating systems, making password syncing across devices simple. This is particularly important if you use multiple browsers or devices. It also saves time and effort when you decide to or need to switch to another operating system.

Furthermore, dedicated password managers offer additional security features — such as a data breach scanner, password health checker, email masking, and secure document storage — that are often missing from browser-based managers.

Methodology

The quantitative research on password storage habits was conducted by Nord Security on March 26–April 4, 2026, and included 1009 Canadian residents aged 18–74, as part of a wider eight-country study of 7,861 respondents from Australia, Canada, France, Germany, Italy, Spain, the UK, and the US.

Tomorrow, June 4, Microsoft is officially retiring the master password feature for its Edge browser.

The move marks the end of password-based authentication for the browser’s built-in manager and a broader shift toward passwordless authentication across the Microsoft ecosystem. Users will now be required to use device-based authentication methods, such as Windows Hello (PIN, fingerprint, or facial recognition) to access their saved passwords in Edge. It’s the latest move in Microsoft’s offensive against passwords, pushing the world toward a passwordless future of passkeys and biometrics. If you haven’t set up Windows Hello yet, you should act now.

Ignas Valancius, VP of engineering at the cybersecurity company NordPass, comments:

“By disabling the master password in Edge, Microsoft isn’t just changing a setting — they’re forcing a change in habit. While biometrics and passkeys are considered more convenient and secure than passwords, this ‘cold turkey’ transition might become unpleasant for users who prefer to hold on to their passwords.

“And there absolutely are people who prefer passwords, because we’re creatures of habit. We can all relate to that feeling of being in a comfort zone and not wanting to change anything. Users who want to stick with a master password can easily find alternatives in third-party password managers. But personally I think a push toward passwordless authentication is a positive development.

“When people manage too many passwords, they tend to reuse them or create simple variations, such as changing a single letter or number. This practice creates significant vulnerabilities — if one of these accounts is breached, all other accounts sharing the same or a similar password become compromised.

“Microsoft began phasing out password-based authentication last year, starting with its Authenticator app. Passwords and autofill features were moved to the password manager built into the Microsoft Edge browser (similar to how the Google Chrome manager works).

“At the end of February 2026, the company removed support for master passwords in the browser. While it was no longer possible to create a new master password, existing ones continued to function — until now. After June 4, 2026, legacy master passwords will stop working entirely, and users will be able to access the password manager via device authentication only.

“Such steps taken by Big Tech companies have likely helped reduce the number of passwords people juggle. Our recent research shows that the average number of passwords an individual manages dropped from 168 in 2024 to 120 in 2026, with work-related passwords seeing a similar decrease from 87 to 67.

“Users are increasingly opting for the convenience of logging in through single sign-on (SSO) with their primary account, such as Google, Apple, or Facebook. The growing adoption and promotion of password alternatives like passkeys, Apple Face IDs, Windows Hello, and WebAuthn are contributing to this long-awaited decline. Our own offering of passkeys may also have played a role in this trend.”

Passwords need to die. But whether it’s passwordless authentication or PassKeys, it time for the password to die and I am all here for it.

For the first time since NordPass began observing password usage trends in 2020, the average number of passwords managed by an individual has finally decreased. A new study from the password manager provider reveals that in 2026, the average person handles approximately 120 personal and 67 work-related passwords.

This marks a significant reversal of a multi-year trend that saw password burdens skyrocket. The peak was recorded in 2024, when the average user was juggling 168 personal and 87 business-related passwords.

First decrease

NordPass has chronicled the expanding digital footprint of the average user. An initial research in February 2020, just before the COVID-19 pandemic, found users managed around 80 passwords. That number quickly jumped by 25% to 100 within the first eight months of the pandemic, beginning a steady climb that has only now started to recede.

The new data offers hope that passwords are finally being replaced by passkeys and other login methods. But he stresses that these figures should be interpreted cautiously because the overall number of accounts and associated login credentials continues to grow.

Also SSO is not always the safest option, especially if a person reuses a password, which around 60% of Americans and Brits do.

Trouble with too many accounts

It’s a well-known security risk that when people manage too many passwords, they often reuse them or create simple variations, such as changing a single letter or number. This practice creates significant vulnerabilities — if one of these accounts is breached, all other accounts sharing the same or a similar password become compromised.

Forgotten or abandoned accounts also pose a security risk because users may overlook data breach notifications and remain unaware that their information has been exposed. In these cases, tools like the Data Breach Scanner can help. They actively scan the internet and dark web for your credentials and alert you if your information appears in a breach, helping to protect even your forgotten accounts.

Methodology: The quantitative research by NordPass was conducted on April 4-15, 2026, and included 1,509 NordPass users.

By Karolis Arbaciauskas, head of product at NordPass

Yet another new authentication method has emerged. A team led by researchers at Rutgers University (USA) has developed a system called “VitalID” based on a newly proposed biometric — tiny vibrations from breathing and heartbeats that resonate through the skull in patterns unique to each person’s bone structure and facial tissues.

This is far from the first attempt to eliminate passwords and the need to remember them. From swallowable microchip pills and electronic tattoos to logging in via the echo of your skull, the tech industry has spent more than a decade searching for the password’s successor.

“Nobody likes passwords. We all have too many of them — about 170 on average, by our count. And we can’t remember them all, so people reuse passwords, and those reused credentials often become a common attack vector. It’s no surprise that there have been and still are many attempts to free us from passwords and remembering them. At NordPass, we’re also developing passwordless authentication. But for now, there is no universally practical way to live without passwords — especially since not all websites and platforms support passkeys yet,” says Karolis Arbaciauskas, head of product at the password manager company NordPass.

Bizarre passwordless experiments

Let’s take a look at the strangest and most interesting authentication methods proposed.

The password pill. In 2013, around the time Apple’s Touch ID launched, Motorola unveiled a striking prototype — a swallowable authentication pill containing a tiny chip powered by stomach acid. The device produced an 18‑bit, ECG‑like signal that effectively turned the user’s body into an authentication token. It never advanced beyond demos, largely because it felt more like surveillance than authentication, and because Touch ID offered a simpler, far less invasive alternative.

Electronic tattoo. At the same 2013 conference, Motorola also showcased a temporary password tattoo — ultra‑thin, flexible circuits that adhered to the skin for on‑body authentication. The demos were unforgettable, but the concept stalled due to practicality, privacy, and adoption hurdles — users had to replace the tattoo weekly, or it stopped working, making it more cumbersome and costly than passwords. Notably, while that authentication concept faded, similar flexible electronics now power consumer products such as adhesive baby thermometers.

Bone-conducted skull signatures. Researchers have repeatedly explored using the way sound travels through the skull as a unique biometric, from early “SkullConduct” work to recent systems like Rutgers’ VitalID. The core idea is simple — your skull’s acoustic response can be as distinctive as a fingerprint. It’s a clever concept, but so far it has remained largely at the prototype stage because it’s impractical to rely on a head‑mounted device every time you log in. However, VitalID may be on the right track by focusing on virtual and augmented reality environments, where users already wear a device on their heads.

Heartbeat recognition (ECG). Devices like the Nymi Band use a person’s unique heart rhythm as a biometric signature. Because no two ECG patterns are identical, the wearer can authenticate simply by being near authorized devices. This is one of the few experimental methods that actually reached the market — but it remains niche, designed for B2B and research scenarios where staff must authenticate to equipment beyond standard computers (it requires both an ECG bracelet and a compatible reader plugged into a machine). For the mass market, it is still too costly and impractical.

Vein pattern mapping. This method uses infrared light to map the unique vein patterns beneath the skin, typically in the palm or fingers. It is already deployed in high‑security environments such as laboratories and data centers, as well as for patient identification and secure access to electronic medical records (e.g., Imprivata PatientSecure). Like ECG bracelets, however, it remains impractical for mass‑market use because it requires specialized sensors or additional hardware on smartphones and computers.

Lip-reading software. Researchers have developed systems that identify users based on the unique way they mouth specific words or phrases. While the technology is now relatively mature, it is used more often to support solutions for people with hearing impairments and for forensic analysis (e.g., extracting speech cues from silent CCTV footage). It could be applied to authentication, but it remains impractical — most users won’t want to mouth passphrases at a computer or phone every time they log in.

Ear shape, heartbeat, gait, and odor. Over the years, various academic teams have tested everything from ear morphology and gait to body odor and body proportions as identity signals. While these traits can be distinctive, they struggle with reliability, sensor availability, and user acceptance, which is why you don’t scan your ear or authenticate by aroma at the office door.

Mainstream biometrics

So far, the search for a password successor has produced few mainstream winners. Only a handful of biometrics — primarily face and fingerprint — have become everyday tools. Passkeys, a phishing‑resistant login method built on on‑device biometrics and supported by technology heavyweights, are progressing in the same direction, but their adoption is slower than expected.

“Fingerprint login became mainstream in 2013 and face scan in 2017, driven primarily by Apple’s introduction of Touch ID and Face ID. These technologies succeeded because they are simple to use, fast, built into phones and laptops, and work offline on the device. Voice recognition as a biometric authentication has been demoed some time ago and even existed for some time but never became common. Now that AI can clone a voice from a few seconds of audio, it’s not reliable. Keystroke dynamics also exist. AI can infer identity from typing patterns, but this technology also remains niche. AI can recognize handwriting as well, though that’s more relevant to forensic analysis than authentication,” says Arbaciauskas.

Most likely successor

According to him, passkeys have the potential to become the dominant form of authentication because they are based on previous technology that is already built into nearly all modern devices and solves the password problem.

“Passkeys replace passwords with public‑key cryptography. A private key stays on your device, while a website holds the public key. When you sign in, your phone or laptop proves possession of the private key — often unlocked by your fingerprint or face — without revealing anything that can be phished or reused. As a result, passkeys are resistant to phishing, credential stuffing, and brute‑force guessing. Major platforms now support them, and modern password managers include passkey functionality to help organizations and users adopt them,” says Arbaciauskas.

He adds that even with broad platform support, it will take years for websites, apps, and enterprises to standardize on passkeys. During this transition, we live in a mixed world — some accounts support passkeys, while many still rely on passwords, so we’re using both for now.

“Use passkeys wherever they’re available. Everywhere else, use long, unique, randomly generated passwords stored in a password manager. These are harder to phish or disclose in the heat of the moment because you don’t memorize them. And always enable multi‑factor authentication,” says Arbaciauskas.

A new analysis reveals that a common habit of making small tweaks to existing passwords — such as adding a number or changing a symbol in an existing password, instead of creating a unique one — is a massive security risk that hackers easily exploit. Despite company policies and security training, this widespread practice of using near-identical passwords remains one of the biggest, most underestimated threats, cybersecurity experts warn.

This risky behaviour is indeed widespread. NordPass’ password reuse survey reveals that 62% of Americans, 60% of Brits, and 50% of Germans reuse passwords across multiple online accounts. On average, people reuse passwords for about five accounts, with one-fifth admitting to reusing them for 10 or more accounts. 

“This risky habit, affecting nearly three in five users, creates a domino effect of vulnerability, where a single compromised password can unlock an entire digital life,” says Karolis Arbaciauskas, head of product at NordPass. 

Adding a letter, a number, or a symbol

According to the survey data, 68% of Americans who reuse passwords make at least some changes before reusing them. The same is true for 62% of Brits and 61% of Germans. The most common change is adding or changing a number, symbol, or letter.

“Such a lax approach to security can result in stolen data or an emptied bank account, and a lot of anxiety,” says Arbaciauskas. “However, I must agree that, in terms of sheer damage that a threat actor could do, this practice is an especially dangerous phenomenon in the corporate environment. Because it technically does not violate most password policies, and it often stays unnoticed by administrators. This way, it can become an entry point for threat actors, who would gladly extort or blackmail the company.”

Most common variations 

In the “Top 200 most common passwords 2025” list, researchers found 119 nearly identical passwords, which were divided into seven approximate groups:

• Sequential number variations. Examples: 12345, 123456, 1234567,987654321.
• “Admin” variations. Examples: admin, Admin, adminadmin, admin123.
• “Password” variations. Example: password, Password1, p@ssw0rd, Passw0rd.
• Keyboard pattern variations. Examples: qwerty, qwerty123, abcd1234, Abcd@1234.
• Repetitive pattern variations. Examples: 11111111, 111111111, aa112233, aabb1122.
• Common word variations. Examples: welcome, Welcome1, test123, Test@123.
• Prefix/suffix variations. Examples: a123456, Aa123456, Aa@123456, 12345678a.

The most numerous groups are sequential number variations, keyboard pattern variations, and repetitive pattern variations.

“This is just a rough breakdown, based on variations of the same passwords. However, in principle, all 200 passwords can be placed into certain predictable categories. For example, when compiling the list itself, we noticed that popular names and surnames, place names, swear words, brand names and equivalents of the word ‘password’ in various languages, are often used as passwords. Often with added numbers or special characters. Those passwords feel unique, but are all predictable patterns. Threat actors know this, and the automated hacking tools they use, most certainly can apply common transformations, such as adding or changing characters, and incrementing numbers,” says Arbaciauskas.

Why do people reuse passwords?

A third of internet users who reuse passwords say they do it because they have too many accounts to manage different passwords for each one. About 25% say that they find it inconvenient to create and manage unique passwords. 

“People reuse passwords because it’s easier that way. Between work tools, financial apps, subscriptions, social networks, online shopping, and gaming, the number of accounts adds up quickly. The average person has around 170 passwords. Remembering unique passwords for all of them isn’t realistic. But it is worrying that, despite repeated warnings, about 10% of respondents still don’t think there’s a significant risk in reusing passwords. This mindset is a disaster waiting to happen. Threat actors could gain access to all your accounts, your identity could be stolen, and your credit card — maxed out, or a loan could be taken out in your name. In a corporate setting, this behaviour could cost millions, if you let ransomware in,” says Arbaciauskas.

Password safety tips

According to Arbaciauskas, a few general rules can greatly improve digital hygiene and help avoid falling victim to cyberattacks due to ineffective password management:

• Security training. Many companies are already doing this. Although this doesn’t always work — sometimes even cybersecurity professionals get fooled — training bears fruit. Companies that run regular security workshops experience fewer cases of reused credentials, and employees often use this knowledge in personal life.
• Password policies and technologies. Companies should have robust password policies. Ideally, the company’s system would automatically compare newly created passwords with those already leaked on the dark web and prevent the creation of one that is the same or very similar to the one already leaked. It’s best to use password generators for both personal and work accounts.
• Multi‑factor authentication (MFA). So far, this is the most reliable and convenient way to provide additional protection for business and personal accounts. MFA, which requires you to provide a one-time code when logging in, can stop account takeover even when the threat actors have your password.
• Password manager. It can help you generate, store, manage, and safely share passwords. A password manager removes the need to rely on memory altogether. Instead of trying to come up with something clever or easy to remember it creates long, random passwords that don’t follow patterns. And you don’t need to remember them — just autofill or copy paste.
• Consider passkeys. A passkey pairs public‑key cryptography with device biometrics, so there’s nothing to type, nothing to forget, and nothing to reuse. Although adoption is somewhat slower than expected, many major platforms already support them. Where passkeys are unavailable, turn on MFA.