If any of your passwords are on this list, go and change them now.

SplashData, which makes password management applications, has released its annual “Worst Passwords” list compiled from common passwords that are posted by hackers. The top three — “password,” “123456,” and “12345678″ — have not changed since last year. New ones include “jesus,” “ninja,” “mustang,” “password1,” and “welcome.” Other passwords have moved up and down on the list.

The most surprising addition is probably “welcome.”

“That means people are not even changing default passwords,” CEO Morgan Slain told TIME Tech. “It doesn’t take that much time to make a new password.”

You should have different passwords for all of your accounts. To make it easier to remember them all, Slain suggests thinking about passwords as “passphrases.” For instance, use a phrase like “dog eats bone” and add underscores, dashes, hyphens, and other punctuation marks to satisfy the special character requirement: “dog_eats_bone!”

Here’s the full list:

  1. password

2, 123456

  1. 12345678

  2. abc123

  3. qwerty

  4. monkey

  5. letmein

  6. dragon

  7. 111111

  8. baseball

  9. iloveyou

  10. trustno1

  11. 1234567

  12. sunshine

  13. master

  14. 123123

  15. welcome

  16. shadow

  17. ashley

  18. football

  19. jesus

  20. michael

  21. ninja

  22. mustang

  23. password1

Source: CNN