Imagine your 123456 password has already been sold a thousand times in the 10 billion-strong password bazaar of the dark web—a shocking reality given that 81% of data breaches are fueled by weak, stolen, or reused credentials.
Key Takeaways
- In 2023, over 10 billion passwords were exposed in data breaches worldwide according to cybersecurity reports
- The 2023 Verizon Data Breach Investigations Report (DBIR) found that 81% of breaches involved weak, default, or stolen credentials
- RockYou2021 leak contained 8.4 billion unique passwords, the largest compilation ever
- "123456" was the most common password in the 2023 NordPass report, used by millions across leaks
- "123456789" ranked second in commonality, appearing in over 7.7 million leaked passwords per NordPass 2023
- "guest" is the 11th most common password, found in 1.2 million instances in breaches
- 59% of users reuse the exact same password across multiple accounts per 2023 Google survey
- Keeper Security 2023 report: 69% of people reuse passwords on work and personal accounts
- NordPass 2023: 82% of users have reused passwords, leading to credential stuffing attacks
- A 12-character password with uppercase, lowercase, numbers, symbols takes 34 years to crack with modern GPU
- 8-character lowercase-only password cracks in 2.5 hours on single GPU per Hive Systems 2023
- Passwords under 8 characters represent 20% of all leaked but crack 100% faster
- 2FA blocks 99.9% of automated attacks but only 30% adoption, Google 2023
- MFA reduces breach risk by 99% per Microsoft 2023 study on Azure AD
- 2023 Okta report: 37% of attacks bypassed legacy MFA like SMS
Weak and reused passwords are causing billions of accounts to be breached.
Common Weak Passwords
1"123456" was the most common password in the 2023 NordPass report, used by millions across leaks
Verified2"123456789" ranked second in commonality, appearing in over 7.7 million leaked passwords per NordPass 2023
Verified3"guest" is the 11th most common password, found in 1.2 million instances in breaches
Verified4"qwerty" appears in 7.8 million leaked passwords according to Have I Been Pwned
Directional5"password" is used by 3.8 million accounts in pwned databases
Single source6"12345" ranks third, cracked in seconds and common in 95% of leaks
Verified7"admin" is prevalent in IoT devices, found in 2.1 million breaches
Verified8"letmein" appears 376,805 times in RockYou leak
Verified9"welcome" is among top 25, used in 150,000+ instances
Directional10"monkey" ranks high due to keyboard patterns, in 1 million leaks
Single source11"dragon" is a popular fantasy-themed weak password in 500k+ cases
Verified12"iloveyou" sentimental password in 300k breaches
Verified13"baseball" sports-themed, top 20 in US leaks
Verified14"football" another sports entry, 200k occurrences
Directional15"sunshine" nature word, common in 180k passwords
Single source16"trustno1" from X-Files, ironically weak in 150k cases
Verified17"ninja" gaming term, top 50 globally
Verified18"abc123" sequential, in 1.5 million leaks
Verified19"princess" gender-themed, popular among females
Directional20"flower" simple word, 120k instances
Single source21"superman" superhero, top in US
Verified22"batman" another hero, 90k uses
Verified23"master" authority word, common admin pass
Verified24"hello" basic greeting, in 80k breaches
Directional25"freedom" patriotic, US top 100
Single source26"shadow" dark theme, 70k occurrences
Verified27"michael" common name, pet-like password
VerifiedCommon Weak Passwords Interpretation
Despite humanity’s endless creativity, our favorite passwords remain a tragically predictable parade of keyboard strolls, pop culture nods, and wishful thinking, leaving our digital doors wide open.
Multi-Factor Authentication and Alternatives
12FA blocks 99.9% of automated attacks but only 30% adoption, Google 2023
Verified2MFA reduces breach risk by 99% per Microsoft 2023 study on Azure AD
Verified32023 Okta report: 37% of attacks bypassed legacy MFA like SMS
Verified4Passkeys (FIDO2) prevent 100% phishing per Google 2023 trials with 1B+ accounts
Directional5Only 11% of global consumers use MFA despite 70% availability, per Google 2023
Single source6Enterprise MFA adoption: 52% in 2023, up from 40% in 2021, Yubico survey
Verified7SMS MFA vulnerable to SIM swap, used in 15% of ATO fraud per FTC 2023
Verified8Hardware keys stop 99.99% account takeovers, per Duo Security 2022
Verified9Biometrics fail 1 in 50,000 but phishing resistant unlike passwords, NIST 2023
Directional10Passwordless (Windows Hello) cuts helpdesk calls 90%, Microsoft 2023
Single source1176% of breaches exploitable without MFA, Verizon DBIR 2023
Verified12TOTP apps phishable in 10% cases vs 0% for hardware, Google 2023
Verified13Passkey adoption: 7% of Chrome users by mid-2024
Verified14MFA fatigue attacks succeed in 50% of targeted execs, Proofpoint 2023
Directional15FIDO2 websauthn supported by 90% browsers, reduces password use 40%
Single source16Biometric + PIN hybrids secure 95% faster login, Apple 2023 stats
Verified1765% prefer passwordless after trial, per 1Password 2023 survey
Verified18Zero-knowledge password managers encrypt 99.99% client-side, LastPass 2023
Verified19SSH keys used in 80% secure dev environments vs passwords, GitHub 2023
Directional20Certificate-based auth cuts credential theft 85%, Forrester 2023
Single source21Risk-based MFA challenges only 2% logins, improves UX 70%, Okta 2023
Verified22Hardware token reuse risk low, <0.01% compromise rate, Yubico 2024
Verified23Password managers with MFA autofill prevent 95% stuffing, Bitwarden 2023
VerifiedMulti-Factor Authentication and Alternatives Interpretation
Despite the cybersecurity world offering a suite of solutions from 2FA to passkeys that could drastically reduce breaches, we collectively treat them like an optional seatbelt, diligently installing them in only half our digital cars while most people still prefer to just hope the crash never happens.
Password Breaches and Leaks
1In 2023, over 10 billion passwords were exposed in data breaches worldwide according to cybersecurity reports
Verified2The 2023 Verizon Data Breach Investigations Report (DBIR) found that 81% of breaches involved weak, default, or stolen credentials
Verified3RockYou2021 leak contained 8.4 billion unique passwords, the largest compilation ever
Verified4In 2022, 24 billion passwords were leaked across various breaches tracked by Cybernews
Directional5Have I Been Pwned database now includes over 12 billion accounts from 861 breached sites as of 2024
Single source6The 2013 Yahoo breach exposed 3 billion accounts, including hashed passwords
Verified7LinkedIn 2021 scrape leak affected 700 million users' passwords and data
Verified8MySpace 360 million password dump from 2008 breach surfaced in 2016
Verified9Adobe 2013 breach leaked 153 million usernames and encrypted passwords
Directional10Equifax 2017 breach impacted 147 million people, including some credential data
Single source1123andMe data breach in 2023 exposed 6.9 million users' ancestry and health data linked to credentials
Verified12Twitter (X) 2022 breach leaked 200 million email-password pairs
Verified13Dropbox 2012 breach affected 68 million accounts with passwords dumped in 2016
Verified14Zynga 2019 breach exposed 173 million poker game users' credentials
Directional15Under Armour MyFitnessPal 2018 breach impacted 150 million users' emails and hashed passwords
Single source16Marriott 2018-2020 breaches exposed 500 million guest records including passport and payment data
Verified17Capital One 2019 breach affected 106 million customers' data including login credentials
Verified18eBay 2014 breach compromised 145 million user credentials
Verified19Home Depot 2014 breach stole 56 million payment cards and 53 million emails
Directional20Sony Pictures 2014 hack leaked employee credentials and executive data
Single source21Target 2013 breach exposed 40 million cards and 70 million customer credentials
Verified22Anthem 2015 breach hit 78.8 million records including health and login data
Verified23AdultFriendFinder 2016 breach leaked 412 million accounts' details
Verified24Ashley Madison 2015 hack exposed 37 million users' sensitive data
Directional25Canva 2019 breach affected 139 million users with email-password combos
Single source26Neopets 2020 breach dumped 69 million users' passwords from 2006
Verified27Parler 2021 scrape leaked 70 million user posts and credentials
Verified28Trello 2019 leak exposed 15 million workspace credentials via third-party
Verified29NetEase 2015 breach leaked 235 million email-password pairs
DirectionalPassword Breaches and Leaks Interpretation
Despite the staggering billions of passwords leaked and the fact that stolen credentials are the master key to most breaches, humanity's collective security strategy still seems to be hoping our personal "password123" is the one needle the hackers won't find in their ever-growing digital haystack.
Password Reuse Statistics
159% of users reuse the exact same password across multiple accounts per 2023 Google survey
Verified2Keeper Security 2023 report: 69% of people reuse passwords on work and personal accounts
Verified3NordPass 2023: 82% of users have reused passwords, leading to credential stuffing attacks
Verified42022 LastPass breach showed 30% of users reused passwords across services
Directional5Specops 2023 study: 40% of enterprises have employees reusing passwords banned by policy
Single source6Google 2020: 65% of users have reused passwords, 13% use same everywhere
Verified7TeamPassword 2023: 91% of users acknowledge reusing passwords despite risks
Verified852% of people use same password for email and banking per Dashlane 2022
Verified9Cybersecurity Ventures: 81% credential breaches due to reuse in stuffing attacks
Directional102023 Bitwarden survey: 70% of respondents reuse at least 2-3 passwords
Single source11Proofpoint 2022: 66% reuse passwords across personal and work
Verified121Password 2023: 60% admit to password reuse after breaches
Verified13Harris Poll for Aura 2023: 47% use same password for multiple financial sites
Verified1473% of users reuse passwords on social media and email, per Kaspersky 2022
Directional15Enterprise average: 50% password reuse rate in AD environments, Specops 2023
Single source1688% of breaches involve reused credentials per SpyCloud 2022
Verified1755% of millennials reuse passwords frequently, JumpCloud 2023
Verified1862% of Gen Z reuse due to convenience, per NordPass 2023 youth survey
Verified19Corporate reuse: 45% use same password for VPN and email, Ponemon 2022
Directional2076% of hacked accounts had reused passwords from prior breaches, HIBP 2023
Single source21Average user has 100+ passwords but reuses top 5 across sites, per Dashlane 2023
Verified2267% reuse after password manager recommendation ignored, LastPass 2023
Verified23NIST estimates 80% of breaches from weak/reused passwords
Verified2471% of users share reused passwords with family, Aura 2023
DirectionalPassword Reuse Statistics Interpretation
When the password "Fluffy123" becomes the master key to your entire digital life—from banking to social media—it’s no wonder that over half of all breaches involve reused credentials, turning a personal shortcut into a universal skeleton key for cybercriminals.
Password Strength Metrics
1A 12-character password with uppercase, lowercase, numbers, symbols takes 34 years to crack with modern GPU
Verified28-character lowercase-only password cracks in 2.5 hours on single GPU per Hive Systems 2023
Verified3Passwords under 8 characters represent 20% of all leaked but crack 100% faster
Verified4Average password length in breaches is 9.2 characters, per Specops 2023 analysis
Directional5Only 15% of passwords use all character types (upper, lower, num, sym), NordPass 2023
Single source6Dictionary words alone crack in under 1 second with 14 trillion wordlists like RockYou2021
Verified795% of passwords crackable within 24 hours if under 10 chars without complexity
Verified8Entropy of 12-char random password: 71 bits, resistant to brute force till 2030
Verified943% of passwords contain only lowercase letters, crack time <1 minute
Directional10Uppercase inclusion boosts strength by 37x, but only 58% use it
Single source11Numbers in 72% but sequential like 123 in 40%, reducing strength 90%
Verified12Symbols used in just 28% of passwords, increasing crack time 50x when included
Verified13Keyboard patterns (qwerty, 123) in 13% of passwords, crack <10 seconds
Verified14Personal info (names, DOB) in 22%, guessed easily via social engineering
Directional15Passphrases of 4 random words (20 chars) have 40+ bits entropy, better than complex 8-char
Single source1667% of enterprise passwords fail NIST 800-63B strength checks
Verified17GPU cluster cracks 100 billion hashes/sec for MD5, weak hashes on 80% old breaches
Verified18Average crack time for top 1 million common passwords: instant
Verified19Leet speak (p@ssw0rd) only delays crack by 2-5x, still weak
Directional208-char complex password cracks in 7 hours on RTX 4090, per Hive 2024 update
Single source21Passwords with repeats (aaa123) 50% weaker per entropy calc
Verified2225% of passwords are 6 chars or less, 100% crackable offline
Verified23Diceware 6-word passphrase: 77 bits, secure for 100+ years
Verified24Only 5% of users change passwords annually without breach force
DirectionalPassword Strength Metrics Interpretation
While the statistics reveal a woefully predictable human tendency towards simplicity—choosing a laughably weak eight-letter password that cracks in the time it takes to watch a long movie over a robust twelve-character one that outlasts many mortgages—our collective security posture remains a masterclass in willful vulnerability.
Sources & References
- Reference 1HAVEIBEENPWNEDhaveibeenpwned.comVisit source
- Reference 2VERIZONverizon.comVisit source
- Reference 3BLEEPINGCOMPUTERbleepingcomputer.comVisit source
- Reference 4CYBERNEWScybernews.comVisit source
- Reference 5BBCbbc.comVisit source
- Reference 6TROYHUNTtroyhunt.comVisit source
- Reference 7ZDNETzdnet.comVisit source
- Reference 8FTCftc.govVisit source
- Reference 9REUTERSreuters.comVisit source
- Reference 10NEWSnews.marriott.comVisit source
- Reference 11CAPITALONEcapitalone.comVisit source
- Reference 12CORPORATEcorporate.homedepot.comVisit source
- Reference 13SONYsony.comVisit source
- Reference 14CORPORATEcorporate.target.comVisit source
- Reference 15ANTHEManthem.comVisit source
- Reference 16CANVAcanva.comVisit source
- Reference 17BUSINESSINSIDERbusinessinsider.comVisit source
- Reference 18BLOGblog.trello.comVisit source
- Reference 19INFOSECURITY-MAGAZINEinfosecurity-magazine.comVisit source
- Reference 20NORDPASSnordpass.comVisit source
- Reference 21SPECTRUMspectrum.ieee.orgVisit source
- Reference 22KASPERSKYkaspersky.comVisit source
- Reference 23GITHUBgithub.comVisit source
- Reference 24KEEPERSECURITYkeepersecurity.comVisit source
- Reference 25SPICEWORKSspiceworks.comVisit source
- Reference 26BLOGblog.googleVisit source
- Reference 27BLOGblog.lastpass.comVisit source
- Reference 28SPECOPSSOFTspecopssoft.comVisit source
- Reference 29PASSWORDMANAGERpasswordmanager.comVisit source
- Reference 30TEAMPASSWORDteampassword.comVisit source
- Reference 31BLOGblog.dashlane.comVisit source
- Reference 32CYBERSECURITYVENTUREScybersecurityventures.comVisit source
- Reference 33BITWARDENbitwarden.comVisit source
- Reference 34PROOFPOINTproofpoint.comVisit source
- Reference 351PASSWORD1password.comVisit source
- Reference 36AURAaura.comVisit source
- Reference 37SPYCLOUDspycloud.comVisit source
- Reference 38JUMPCLOUDjumpcloud.comVisit source
- Reference 39PONEMONponemon.orgVisit source
- Reference 40LASTPASSlastpass.comVisit source
- Reference 41NVLPUBSnvlpubs.nist.govVisit source
- Reference 42HIVE-SYSTEMShive-systems.comVisit source
- Reference 43PAGESpages.nist.govVisit source
- Reference 44XKCDxkcd.comVisit source
- Reference 45HASHCAThashcat.netVisit source
- Reference 46ZXCVBNzxcvbn.pm.davidwong.frVisit source
- Reference 47WORLDworld.std.comVisit source
- Reference 48LANDINGlanding.google.comVisit source
- Reference 49MICROSOFTmicrosoft.comVisit source
- Reference 50OKTAokta.comVisit source
- Reference 51SECURITYsecurity.googleblog.comVisit source
- Reference 52YUBICOyubico.comVisit source
- Reference 53DUOduo.comVisit source
- Reference 54TECHCOMMUNITYtechcommunity.microsoft.comVisit source
- Reference 55CHROMESTATUSchromestatus.comVisit source
- Reference 56FIDOALLIANCEfidoalliance.orgVisit source
- Reference 57SECURITYsecurity.apple.comVisit source
- Reference 58GITHUBgithub.blogVisit source
- Reference 59FORRESTERforrester.comVisit source