More than 23 billion passwords were exposed in breaches as of 2023, and over 1 in 3 data breaches begin with phishing aimed at stealing logins. The timeline is messy and fast, but the pattern is consistent as weak and stolen credentials keep getting reused at scale. Let’s break down the credential pileups, cracked vaults, and the password attack techniques that keep showing up.
Key Takeaways
- 3.2 billion credentials from 100+ breaches in 2022
- LinkedIn breach exposed 700 million passwords in 2021
- Yahoo's 2013 breach leaked 3 billion accounts
- 81% of hacking-related breaches leveraged weak, default, or stolen passwords in 2023
- In 2022, credential stuffing attacks accounted for 30% of all breaches
- 74% of breaches in 2021 involved compromised credentials
- MFA reduces unauthorized access by 99.9%
- Passwordless logins block 99% of automated attacks
- Password managers prevent 80% of reuse issues
- Average password cracked in 7 seconds with modern hardware
- 83% of passwords can be cracked in under a day
- Top 10,000 passwords crack 98% of attempts offline
- 68% of people reuse passwords across accounts
- 59% of users share passwords with others
- Only 24% use password managers regularly
Billions of breached passwords prove credential reuse and weak defenses still drive most password attacks.
Related reading
01 · Category
Data Breaches Involving Passwords26 stats
01
3.2 billion credentials from 100+ breaches in 2022
02
LinkedIn breach exposed 700 million passwords in 2021
03
Yahoo's 2013 breach leaked 3 billion accounts
04
RockYou 2009 dump: 32 million plaintext passwords
05
Marriott breach 2018: 500 million guest passwords
06
Adobe 2013: 153 million encrypted passwords cracked
07
Equifax 2017: 147 million credentials exposed
08
MySpace 2016: 360 million passwords leaked
09
Dropbox 2012: 68 million passwords in 2016 leak
10
Twitter 2009: 33 million passwords from 2022 leak
11
Sony 2011: 77 million PlayStation passwords
12
eBay 2014: 145 million user credentials
13
Capital One 2019: 100 million customer passwords
14
Zynga 2019: 218 million passwords from Words with Friends
15
Neopets 2020: 69 million passwords exposed
16
Canva 2022: 4 million passwords stolen
17
Twitter 2022: 5.4 million API keys and passwords
18
LastPass 2022: Encrypted password vaults stolen
19
MOVEit 2023: 60 million passwords from supply chain
20
MGM Resorts 2023: 10.6 billion passwords in infostealer dump
21
23andMe 2023: 6.9 million passwords via credential stuffing
22
Optus 2022: 10 million Australian passwords
23
T-Mobile 2021: 54 million passwords leaked
24
Facebook 2019: 533 million passwords in plain text
25
Under Armour 2020: 150 million MyFitnessPal passwords
26
Ticketmaster 2023: 560 million passwords rumored
Interpretation
Data Breaches Involving Passwords Interpretation
We've apparently decided that the most convenient way to manage our billions of collective online passwords is to store them in a series of easily hackable public spreadsheets.
02 · Category
Incidence Rates29 stats
01
81% of hacking-related breaches leveraged weak, default, or stolen passwords in 2023
02
In 2022, credential stuffing attacks accounted for 30% of all breaches
03
74% of breaches in 2021 involved compromised credentials
04
Password attacks rose by 25% year-over-year in 2023 per Akamai
05
1 in 3 data breaches start with a phishing attack targeting passwords in 2023
06
Brute force attacks increased 300% during COVID-19 lockdowns
07
23 billion passwords exposed in breaches as of 2023
08
Over 500 million accounts hit by credential stuffing in 2022
09
Password spraying attacks up 550% in 2023
10
40% of organizations faced password breach attempts daily in 2023
11
68% of enterprises experienced at least one password-related breach in 2022
12
Global password attacks hit 15 billion per month in 2023
13
29% of all breaches in 2023 were due to stolen credentials
14
Credential abuse was factor in 50% of initial access vectors
15
3.9 billion login attempts blocked as malicious in Q1 2023
16
Password guessing accounts for 17% of web app attacks
17
80 million unique passwords cracked in RockYou2021 dump
18
Daily average of 2,000 password attacks per organization
19
61% rise in automated password attacks in 2023
20
123456 remains top targeted password in 85% of attacks
21
Hybrid brute-force attacks surged 71% in 2022
22
45% of RDP attacks target weak passwords
23
Over 100 billion passwords leaked historically
24
25% of breaches exploit default credentials
25
Phishing for passwords succeeds in 1 out of 10 attempts
26
193 million API keys and passwords exposed on GitHub in 2023
27
Password reuse leads to 52% of breaches
28
70% of hacked accounts use duplicate passwords
29
1.4 billion credentials circulating on dark web in 2023
Interpretation
Incidence Rates Interpretation
Despite the glaring and relentless evidence that passwords are humanity's favorite digital liability, we seem oddly committed to treating them like a dull knife in a gunfight.
03 · Category
Mitigation Strategies30 stats
01
MFA reduces unauthorized access by 99.9%
02
Passwordless logins block 99% of automated attacks
03
Password managers prevent 80% of reuse issues
04
2FA stops 96% of account takeover attempts
05
Hardware keys reduce phishing success by 100%
06
Rate limiting cuts brute force by 99%
07
Passkeys block credential stuffing entirely
08
Biometrics reduce password attacks by 90%
09
Zero-knowledge encryption in managers unbreakable
10
Password auditing tools find 85% weak passwords
11
CAPTCHA blocks 95% bot logins
12
Account lockout after 5 fails stops 98% attacks
13
Argon2 hashing increases crack time 1000x
14
Monitoring dark web leaks prevents 70% breaches
15
SSO reduces password surface by 50%
16
Behavioral biometrics detects 99% anomalies
17
PKI certs eliminate password needs
18
Passwordless adoption grew 300% in 2023
19
Training reduces phishing clicks by 40%
20
WebAuthn standard resists phishing 100%
21
Entropy checks block 75% weak entries
22
Breach alerts change 60% of passwords proactively
23
YubiKey reduces breaches by 99.9% in tests
24
Adaptive auth blocks 92% risky logins
25
No plain-text storage cuts leak impact 100%
26
Peppering salts boosts security 50x
27
Automated rotation cuts exposure 80%
28
FIDO2 adoption halves support tickets
29
Honeypot accounts trap 85% attackers
30
Quantum-resistant hashing in dev 10x slower
Interpretation
Mitigation Strategies Interpretation
While the modern password still stubbornly exists, the statistics prove we've brilliantly built an entire digital moat around it, filled with biometric alligators, cryptographic sharks, and the occasional YubiKey-guided laser.
More related reading
04 · Category
Password Vulnerabilities30 stats
01
Average password cracked in 7 seconds with modern hardware
02
83% of passwords can be cracked in under a day
03
Top 10,000 passwords crack 98% of attempts offline
04
51% of passwords contain personal info like names
05
Only 8 characters long passwords crack in minutes
06
Dictionary attacks succeed on 30% of hashed passwords
07
91% of passwords fail basic NIST standards
08
Rainbow tables crack NTLM hashes in seconds
09
76% of users have passwords under 12 characters
10
GPU cracking speed hits 100 billion hashes/sec for MD5
11
24% of passwords use sequential keys like qwerty
12
SHA-1 hashes crackable for 40% of passwords under 8 chars
13
65% of passwords vulnerable to hybrid attacks
14
Common passwords like 'password123' crack instantly
15
42% of breached passwords were less than 8 characters
16
bcrypt with low rounds cracks 20% faster on ASICs
17
88% of passwords reuse top 1000 common ones
18
Password entropy below 40 bits for 70% of users
19
LLM-generated passwords crack 15% easier due to patterns
20
55% of passwords include dates like birthdays
21
Argon2 recommended as 50% slower to crack than scrypt
22
96% of 4-digit PINs crackable in under 20 hours
23
Keyboard patterns cover 10% of all passwords
24
Weak salts allow 90% mass cracking
25
67% of corporate passwords crackable offline
26
Passphrases with 4 words average 44 bits entropy
27
73% vulnerable to rule-based mutations
28
MD5 collision attacks bypass 25% of hashes
29
12-character passwords take 34 years to crack online
30
82% of passwords fail zxcvbn strength test
Interpretation
Password Vulnerabilities Interpretation
The brutal truth hidden in these statistics is that we are all essentially leaving our digital doors unlocked with passwords so predictable they might as well be written on a post-it note stuck to the front of our houses.
05 · Category
User Habits30 stats
01
68% of people reuse passwords across accounts
02
59% of users share passwords with others
03
Only 24% use password managers regularly
04
52% of users write down passwords insecurely
05
Average user has 100+ passwords to manage
06
91% of users know password hygiene but ignore it
07
73% reuse passwords from work to personal
08
44% use pet names in passwords
09
69% of millennials use social media info in passwords
10
Only 35% change passwords after breach notification
11
81% of consumers use same password everywhere
12
57% admit to using 'password' or variations
13
Average password age is 146 days before change
14
62% of users pick passwords based on ease, not security
15
48% share passwords with family members
16
Only 12% enable 2FA everywhere possible
17
77% of users have 5 or fewer unique passwords
18
65% use birthdays in passwords
19
39% never change default router passwords
20
84% of remote workers reuse passwords insecurely
21
70% of Gen Z use same password for streaming/social
22
55% store passwords in browsers unencrypted
23
67% ignore password expiration policies
24
Average person forgets 3 passwords per month
25
76% use names of loved ones in passphrases
26
Only 28% test password strength before using
27
61% of users pick sports teams for passwords
28
49% use phone numbers in passwords
29
82% don't use unique passwords for banking
30
71% of parents share passwords with kids
Interpretation
User Habits Interpretation
It's frankly staggering that we've become a society both drowning in a sea of passwords and yet so determined to use the same leaky bucket to bail ourselves out, as if digital security were a charming quirk rather than a critical lifeline.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Rachel Svensson. (2026, February 13). Password Hacking Statistics. Gitnux. https://gitnux.org/password-hacking-statistics
MLA
Rachel Svensson. "Password Hacking Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/password-hacking-statistics.
Chicago
Rachel Svensson. 2026. "Password Hacking Statistics." Gitnux. https://gitnux.org/password-hacking-statistics.
Sources & references
94 datasets cited across this report · attribution is report-level
akamai.com