Splashdata has released its annual ranking of the worst passwords of 2017, using data from more than 5 million leaked passwords. For 2017, the world’s most-hacked password is still “123456,” followed by “Password.”

Between them, these two passwords have ruled the ranking sine 2011, and that’s no surprise, since they’re the easiest and most predictable passwords to hack.

Users can improve password security by finding a series of letters, numbers and symbols that’s relatively complex, but which can be easily remembered. Try using the first letters of a phrase or a song title, for example. Finally, it’s important never to use the same password twice and to make sure you change passwords regularly, once per quarter, for example.

Top 20 most-hacked passwords of 2017:

1. 123456
2. password
3. 12345678
4. qwerty
5. 12345
6. 123456789
7. letmein
8. 1234567
9. football
10. iloveyou
11. admin
12. welcome
13. monkey
14. login
15. abc123
16. starwars
17. 123123
18. dragon
19. passw0rd
20. master