While the daunting reality that 81% of hacking-related breaches leverage stolen or weak passwords might seem like just another statistic, this simple gateway remains the overwhelming favorite for cybercriminals who are launching billions of automated attacks every single month.
Key Takeaways
- 81% of hacking-related breaches leveraged weak, default, or stolen passwords in 2023
- In 2022, credential stuffing attacks accounted for 30% of all breaches
- 74% of breaches in 2021 involved compromised credentials
- Average password cracked in 7 seconds with modern hardware
- 83% of passwords can be cracked in under a day
- Top 10,000 passwords crack 98% of attempts offline
- 3.2 billion credentials from 100+ breaches in 2022
- LinkedIn breach exposed 700 million passwords in 2021
- Yahoo's 2013 breach leaked 3 billion accounts
- 68% of people reuse passwords across accounts
- 59% of users share passwords with others
- Only 24% use password managers regularly
- MFA reduces unauthorized access by 99.9%
- Passwordless logins block 99% of automated attacks
- Password managers prevent 80% of reuse issues
Weak passwords cause most data breaches, posing a constant and major security risk.
Data Breaches Involving Passwords
13.2 billion credentials from 100+ breaches in 2022
Verified2LinkedIn breach exposed 700 million passwords in 2021
Verified3Yahoo's 2013 breach leaked 3 billion accounts
Verified4RockYou 2009 dump: 32 million plaintext passwords
Directional5Marriott breach 2018: 500 million guest passwords
Single source6Adobe 2013: 153 million encrypted passwords cracked
Verified7Equifax 2017: 147 million credentials exposed
Verified8MySpace 2016: 360 million passwords leaked
Verified9Dropbox 2012: 68 million passwords in 2016 leak
Directional10Twitter 2009: 33 million passwords from 2022 leak
Single source11Sony 2011: 77 million PlayStation passwords
Verified12eBay 2014: 145 million user credentials
Verified13Capital One 2019: 100 million customer passwords
Verified14Zynga 2019: 218 million passwords from Words with Friends
Directional15Neopets 2020: 69 million passwords exposed
Single source16Canva 2022: 4 million passwords stolen
Verified17Twitter 2022: 5.4 million API keys and passwords
Verified18LastPass 2022: Encrypted password vaults stolen
Verified19MOVEit 2023: 60 million passwords from supply chain
Directional20MGM Resorts 2023: 10.6 billion passwords in infostealer dump
Single source2123andMe 2023: 6.9 million passwords via credential stuffing
Verified22Optus 2022: 10 million Australian passwords
Verified23T-Mobile 2021: 54 million passwords leaked
Verified24Facebook 2019: 533 million passwords in plain text
Directional25Under Armour 2020: 150 million MyFitnessPal passwords
Single source26Ticketmaster 2023: 560 million passwords rumored
VerifiedData Breaches Involving Passwords Interpretation
We've apparently decided that the most convenient way to manage our billions of collective online passwords is to store them in a series of easily hackable public spreadsheets.
Incidence Rates
181% of hacking-related breaches leveraged weak, default, or stolen passwords in 2023
Verified2In 2022, credential stuffing attacks accounted for 30% of all breaches
Verified374% of breaches in 2021 involved compromised credentials
Verified4Password attacks rose by 25% year-over-year in 2023 per Akamai
Directional51 in 3 data breaches start with a phishing attack targeting passwords in 2023
Single source6Brute force attacks increased 300% during COVID-19 lockdowns
Verified723 billion passwords exposed in breaches as of 2023
Verified8Over 500 million accounts hit by credential stuffing in 2022
Verified9Password spraying attacks up 550% in 2023
Directional1040% of organizations faced password breach attempts daily in 2023
Single source1168% of enterprises experienced at least one password-related breach in 2022
Verified12Global password attacks hit 15 billion per month in 2023
Verified1329% of all breaches in 2023 were due to stolen credentials
Verified14Credential abuse was factor in 50% of initial access vectors
Directional153.9 billion login attempts blocked as malicious in Q1 2023
Single source16Password guessing accounts for 17% of web app attacks
Verified1780 million unique passwords cracked in RockYou2021 dump
Verified18Daily average of 2,000 password attacks per organization
Verified1961% rise in automated password attacks in 2023
Directional20123456 remains top targeted password in 85% of attacks
Single source21Hybrid brute-force attacks surged 71% in 2022
Verified2245% of RDP attacks target weak passwords
Verified23Over 100 billion passwords leaked historically
Verified2425% of breaches exploit default credentials
Directional25Phishing for passwords succeeds in 1 out of 10 attempts
Single source26193 million API keys and passwords exposed on GitHub in 2023
Verified27Password reuse leads to 52% of breaches
Verified2870% of hacked accounts use duplicate passwords
Verified291.4 billion credentials circulating on dark web in 2023
DirectionalIncidence Rates Interpretation
Despite the glaring and relentless evidence that passwords are humanity's favorite digital liability, we seem oddly committed to treating them like a dull knife in a gunfight.
Mitigation Strategies
1MFA reduces unauthorized access by 99.9%
Verified2Passwordless logins block 99% of automated attacks
Verified3Password managers prevent 80% of reuse issues
Verified42FA stops 96% of account takeover attempts
Directional5Hardware keys reduce phishing success by 100%
Single source6Rate limiting cuts brute force by 99%
Verified7Passkeys block credential stuffing entirely
Verified8Biometrics reduce password attacks by 90%
Verified9Zero-knowledge encryption in managers unbreakable
Directional10Password auditing tools find 85% weak passwords
Single source11CAPTCHA blocks 95% bot logins
Verified12Account lockout after 5 fails stops 98% attacks
Verified13Argon2 hashing increases crack time 1000x
Verified14Monitoring dark web leaks prevents 70% breaches
Directional15SSO reduces password surface by 50%
Single source16Behavioral biometrics detects 99% anomalies
Verified17PKI certs eliminate password needs
Verified18Passwordless adoption grew 300% in 2023
Verified19Training reduces phishing clicks by 40%
Directional20WebAuthn standard resists phishing 100%
Single source21Entropy checks block 75% weak entries
Verified22Breach alerts change 60% of passwords proactively
Verified23YubiKey reduces breaches by 99.9% in tests
Verified24Adaptive auth blocks 92% risky logins
Directional25No plain-text storage cuts leak impact 100%
Single source26Peppering salts boosts security 50x
Verified27Automated rotation cuts exposure 80%
Verified28FIDO2 adoption halves support tickets
Verified29Honeypot accounts trap 85% attackers
Directional30Quantum-resistant hashing in dev 10x slower
Single sourceMitigation Strategies Interpretation
While the modern password still stubbornly exists, the statistics prove we've brilliantly built an entire digital moat around it, filled with biometric alligators, cryptographic sharks, and the occasional YubiKey-guided laser.
Password Vulnerabilities
1Average password cracked in 7 seconds with modern hardware
Verified283% of passwords can be cracked in under a day
Verified3Top 10,000 passwords crack 98% of attempts offline
Verified451% of passwords contain personal info like names
Directional5Only 8 characters long passwords crack in minutes
Single source6Dictionary attacks succeed on 30% of hashed passwords
Verified791% of passwords fail basic NIST standards
Verified8Rainbow tables crack NTLM hashes in seconds
Verified976% of users have passwords under 12 characters
Directional10GPU cracking speed hits 100 billion hashes/sec for MD5
Single source1124% of passwords use sequential keys like qwerty
Verified12SHA-1 hashes crackable for 40% of passwords under 8 chars
Verified1365% of passwords vulnerable to hybrid attacks
Verified14Common passwords like 'password123' crack instantly
Directional1542% of breached passwords were less than 8 characters
Single source16bcrypt with low rounds cracks 20% faster on ASICs
Verified1788% of passwords reuse top 1000 common ones
Verified18Password entropy below 40 bits for 70% of users
Verified19LLM-generated passwords crack 15% easier due to patterns
Directional2055% of passwords include dates like birthdays
Single source21Argon2 recommended as 50% slower to crack than scrypt
Verified2296% of 4-digit PINs crackable in under 20 hours
Verified23Keyboard patterns cover 10% of all passwords
Verified24Weak salts allow 90% mass cracking
Directional2567% of corporate passwords crackable offline
Single source26Passphrases with 4 words average 44 bits entropy
Verified2773% vulnerable to rule-based mutations
Verified28MD5 collision attacks bypass 25% of hashes
Verified2912-character passwords take 34 years to crack online
Directional3082% of passwords fail zxcvbn strength test
Single source31GPU farms crack 10^12 hashes/sec for SHA256
VerifiedPassword Vulnerabilities Interpretation
The brutal truth hidden in these statistics is that we are all essentially leaving our digital doors unlocked with passwords so predictable they might as well be written on a post-it note stuck to the front of our houses.
User Habits
168% of people reuse passwords across accounts
Verified259% of users share passwords with others
Verified3Only 24% use password managers regularly
Verified452% of users write down passwords insecurely
Directional5Average user has 100+ passwords to manage
Single source691% of users know password hygiene but ignore it
Verified773% reuse passwords from work to personal
Verified844% use pet names in passwords
Verified969% of millennials use social media info in passwords
Directional10Only 35% change passwords after breach notification
Single source1181% of consumers use same password everywhere
Verified1257% admit to using 'password' or variations
Verified13Average password age is 146 days before change
Verified1462% of users pick passwords based on ease, not security
Directional1548% share passwords with family members
Single source16Only 12% enable 2FA everywhere possible
Verified1777% of users have 5 or fewer unique passwords
Verified1865% use birthdays in passwords
Verified1939% never change default router passwords
Directional2084% of remote workers reuse passwords insecurely
Single source2170% of Gen Z use same password for streaming/social
Verified2255% store passwords in browsers unencrypted
Verified2367% ignore password expiration policies
Verified24Average person forgets 3 passwords per month
Directional2576% use names of loved ones in passphrases
Single source26Only 28% test password strength before using
Verified2761% of users pick sports teams for passwords
Verified2849% use phone numbers in passwords
Verified2982% don't use unique passwords for banking
Directional3071% of parents share passwords with kids
Single sourceUser Habits Interpretation
It's frankly staggering that we've become a society both drowning in a sea of passwords and yet so determined to use the same leaky bucket to bail ourselves out, as if digital security were a charming quirk rather than a critical lifeline.
Sources & References
- Reference 1VERIZONverizon.comVisit source
- Reference 2AKAMAIakamai.comVisit source
- Reference 3IBMibm.comVisit source
- Reference 4IMPERVAimperva.comVisit source
- Reference 5HAVEIBEENPWNEDhaveibeenpwned.comVisit source
- Reference 6PROOFPOINTproofpoint.comVisit source
- Reference 7PINGIDENTITYpingidentity.comVisit source
- Reference 8OKTAokta.comVisit source
- Reference 9BLOGblog.cloudflare.comVisit source
- Reference 10ATTACKattack.mitre.orgVisit source
- Reference 11OWASPowasp.orgVisit source
- Reference 12BLEEPINGCOMPUTERbleepingcomputer.comVisit source
- Reference 13SENTINELONEsentinelone.comVisit source
- Reference 14HELPNETSECURITYhelpnetsecurity.comVisit source
- Reference 15SPLASHDATAsplashdata.comVisit source
- Reference 16DARKTRACEdarktrace.comVisit source
- Reference 17MICROSOFTmicrosoft.comVisit source
- Reference 18GUARDIANguardian.digitalVisit source
- Reference 19LASTPASSlastpass.comVisit source
- Reference 20HIBPhibp.comVisit source
- Reference 21DIGITALSHADOWSdigitalshadows.comVisit source
- Reference 22HIVEhive.systemsVisit source
- Reference 23SPECOPSSOFTspecopssoft.comVisit source
- Reference 24RESEARCHresearch.checkpoint.comVisit source
- Reference 25NORDPASSnordpass.comVisit source
- Reference 26KASPERSKYkaspersky.comVisit source
- Reference 27USENIXusenix.orgVisit source
- Reference 28PAGESpages.nist.govVisit source
- Reference 29SCHNEIERschneier.comVisit source
- Reference 30KEEPERSECURITYkeepersecurity.comVisit source
- Reference 31OPENWALLopenwall.comVisit source
- Reference 32ARSTECHNICAarstechnica.comVisit source
- Reference 33RAPID7rapid7.comVisit source
- Reference 34SPICEWORKSspiceworks.comVisit source
- Reference 35TARSNAPtarsnap.comVisit source
- Reference 36DROPBOXdropbox.comVisit source
- Reference 37CORRECTHORSEBATTERYSTAPLEcorrecthorsebatterystaple.netVisit source
- Reference 38ARXIVarxiv.orgVisit source
- Reference 39PASSWORDWARDENSpasswordwardens.comVisit source
- Reference 40BIOMETRICSbiometrics.comVisit source
- Reference 41BLACKHATblackhat.comVisit source
- Reference 42XKCDxkcd.comVisit source
- Reference 43TOOLStools.kali.orgVisit source
- Reference 44CRYPTOLOGYcryptology.eecs.umich.eduVisit source
- Reference 45HOWSECUREISMYPASSWORDhowsecureismypassword.netVisit source
- Reference 46GITHUBgithub.comVisit source
- Reference 47HASHCAThashcat.netVisit source
- Reference 48EXPLOIT-DBexploit-db.comVisit source
- Reference 49NEWSnews.marriott.comVisit source
- Reference 50ZDNETzdnet.comVisit source
- Reference 51EQUIFAXSECURITY2017equifaxsecurity2017.comVisit source
- Reference 52TROYHUNTtroyhunt.comVisit source
- Reference 53WIREDwired.comVisit source
- Reference 54BBCbbc.comVisit source
- Reference 55EBAYINCebayinc.comVisit source
- Reference 56CAPITALONEcapitalone.comVisit source
- Reference 57CANVAcanva.comVisit source
- Reference 58BLOGblog.lastpass.comVisit source
- Reference 59PROGRESSprogress.comVisit source
- Reference 60BLOGblog.23andme.comVisit source
- Reference 61OPTUSoptus.com.auVisit source
- Reference 62T-MOBILEt-mobile.comVisit source
- Reference 63BUSINESSINSIDERbusinessinsider.comVisit source
- Reference 64ABOUTabout.underarmour.comVisit source
- Reference 65CYBERNEWScybernews.comVisit source
- Reference 66PONEMONponemon.orgVisit source
- Reference 67NORTONnorton.comVisit source
- Reference 68DASHLANEdashlane.comVisit source
- Reference 69JSCRAMBLERjscrambler.comVisit source
- Reference 70TEAMBLINDteamblind.comVisit source
- Reference 71GOOGLEgoogle.comVisit source
- Reference 72UPGUARDupguard.comVisit source
- Reference 73THINKWITHGOOGLEthinkwithgoogle.comVisit source
- Reference 74PASSWORDMANAGERpasswordmanager.comVisit source
- Reference 75BEYONDTRUSTbeyondtrust.comVisit source
- Reference 76PSYCHOLOGYTODAYpsychologytoday.comVisit source
- Reference 77HABITSLABShabitslabs.comVisit source
- Reference 78BITWARDENbitwarden.comVisit source
- Reference 79CONSUMERREPORTSconsumerreports.orgVisit source
- Reference 80FAMILYSAFETYINSTITUTEfamilysafetyinstitute.orgVisit source
- Reference 81FIDOALLIANCEfidoalliance.orgVisit source
- Reference 82THALESGROUPthalesgroup.comVisit source
- Reference 831PASSWORD1password.comVisit source
- Reference 84CLOUDcloud.google.comVisit source
- Reference 85CHEATSHEETSERIEScheatsheetseries.owasp.orgVisit source
- Reference 86ARGON2argon2.comVisit source
- Reference 87BEHAVIORALBIOMETRICSbehavioralbiometrics.comVisit source
- Reference 88CSRCcsrc.nist.govVisit source
- Reference 89HIDGLOBALhidglobal.comVisit source
- Reference 90WEBAUTHNwebauthn.guideVisit source
- Reference 91YUBICOyubico.comVisit source
- Reference 92RISKBASEDSECURITYriskbasedsecurity.comVisit source
- Reference 93HASHICORPhashicorp.comVisit source
- Reference 94THREATPOSTthreatpost.comVisit source