If you're still using a weak password, you're not alone—and you're part of the reason weak passwords are the leading cause of data breaches, implicated in over 80% of security incidents last year.
Key Takeaways
- In 2023, 81% of confirmed data breaches involved compromised credentials, primarily weak passwords.
- Over 15 billion passwords have been exposed in data breaches as of 2023.
- In 2022, 74% of breaches exploited weak passwords per IBM Cost of a Data Breach Report.
- The password "123456" was used by 2.5% of all accounts in the 2023 SplashData report.
- Password "password" ranks #1 in breaches, appearing in 0.54% of leaked credentials.
- "qwerty" is the second most common password, used by over 1 million accounts yearly.
- 23% of users still use their birth year as part of their password according to a 2022 Google study.
- 52% of Americans reuse the same password across multiple sites per 2023 Keeper report.
- Users change passwords every 90 days on average in enterprises, but 60% reuse old ones.
- Average password length across internet users is 8.6 characters per a 2023 NordPass analysis.
- Only 15% of passwords meet minimum complexity requirements (upper, lower, number, symbol).
- Entropy of a 12-character random password is about 72 bits, sufficient for most uses.
- NIST recommends passwords of at least 8 characters but ideally 12-16 for better entropy.
- 42% of people use passwords longer than 12 characters post-2022 awareness campaigns.
- Only 26% of organizations enforce password managers.
Weak passwords remain a primary entry point for cybercriminals, consistently ranking among the top contributors to the data breaches and security incidents that dominate headlines in 2026.
Common Passwords
1The password "123456" was used by 2.5% of all accounts in the 2023 SplashData report.
Verified2Password "password" ranks #1 in breaches, appearing in 0.54% of leaked credentials.
Verified3"qwerty" is the second most common password, used by over 1 million accounts yearly.
Verified4"123456789" accounts for 0.41% of all pwned passwords.
Directional5Password "admin" appears in 0.12% of breached databases.
Single source6"Password1" is the 5th most common, used by 0.2% of accounts.
Verified7"abc123" ranks #7, cracked instantly in rainbow tables.
Verified825% of passwords are "12345678" or variations.
Verified9"iloveyou" used by 0.15% globally per annual reports.
Directional10"monkey" ranks top 10 pet-named passwords.
Single source11"football" top sports password, 0.08% usage.
Verified12"welcome" common default, used in 0.1% breaches.
Verified13"sunshine" weather-themed, top 20 common.
Verified14"princess" top female-named password.
DirectionalCommon Passwords Interpretation
Humanity's collective digital front door is secured by the intellectual might of a pet rock.
Password Breaches and Leaks
1In 2023, 81% of confirmed data breaches involved compromised credentials, primarily weak passwords.
Verified2Over 15 billion passwords have been exposed in data breaches as of 2023.
Verified3In 2022, 74% of breaches exploited weak passwords per IBM Cost of a Data Breach Report.
Verified4Data breaches rose 20% in 2023, with passwords involved in 95% of initial access.
Directional5Microsoft accounts saw 300 million password attacks daily in 2023.
Single source6LinkedIn breach 2012 exposed 167 million unique passwords.
Verified7Yahoo breach 2013-2016 leaked 3 billion passwords, many unsalted.
Verified8Adobe breach 2013 exposed 153 million passwords, mostly MD5 hashed.
Verified9RockYou.txt leak contains 32 million unique plaintext passwords.
Directional1047% increase in password spraying attacks in 2023.
Single source11MySpace 2016 breach dumped 360 million passwords.
Verified1281% of hacking-related breaches use stolen or weak credentials.
Verified13Dropbox 2012 breach affected 68 million accounts' passwords.
Verified14Equifax 2017 breach indirectly led to password resets for millions.
Directional15Twitter 2022 breach leaked 200 million emails and passwords.
Single source16LinkedIn 2021 scrape exposed 700 million user passwords indirectly.
Verified17Ashley Madison 2015 breach revealed 36 million passwords.
Verified1867% of breaches start with phishing leading to password theft.
Verified193.9 billion passwords leaked cumulatively by 2023.
Directional20Marriott 2018 breach hit 500 million guest passwords.
Single source21Zynga 2019 breach exposed 218 million passwords.
Verified22Capital One 2019 breach involved stolen AWS credentials passwords.
Verified23Desarrollos 2021 leak: 61 million passwords.
Verified24Facebook 2019 breach: 533 million passwords scraped.
Directional25Collection #1-5 leaks: 22 billion password pairs.
Single source26Canva 2023 breach: 4 billion lines, millions passwords.
Verified27NetEase 2015: 235 million passwords leaked.
Verified28Dubsmash 2020: 162 million passwords exposed.
Verified29Wattpad 2020: 270 million accounts passwords.
DirectionalPassword Breaches and Leaks Interpretation
The startling statistics reveal that our collective password hygiene is so disastrously lax, it's essentially a global open invitation for cybercriminals, who RSVP millions of times a day by using our own embarrassingly predictable or stolen credentials against us.
Password Strength
1Average password length across internet users is 8.6 characters per a 2023 NordPass analysis.
Verified2Only 15% of passwords meet minimum complexity requirements (upper, lower, number, symbol).
Verified3Entropy of a 12-character random password is about 72 bits, sufficient for most uses.
Verified4Top 25 passwords crack in under 1 second with modern GPU hashing.
Directional5Average time to crack an 8-char password with numbers only: 2 hours on RTX 4090.
Single source673% of passwords contain at least one dictionary word.
Verified78-character passwords with mixed case crack in 1 day average.
Verified8Passphrases of 4 random words provide 40+ bits entropy easily.
Verified9Passwords with 14+ chars resist brute force for centuries.
Directional10SHA-1 hashed passwords crack 2.5x faster than bcrypt.
Single source1176% of accounts use passwords weaker than policy allows.
Verified12Diceware method generates passwords crackable only after 10^18 guesses.
Verified1311-char passwords with symbols take 34 years to crack offline.
Verified14GPU clusters crack NTLM hashes at 100B/s speeds.
Directional15Biometrics fail 1.2% vs passwords 0.5% false positives.
Single source1615-char random password entropy: 90 bits, unbreakable.
Verified17Leetspeak passwords crack 40% faster with rulesets.
Verified1810-char lower+upper+digit: 1 week crack time.
Verified19Argon2 hashing slows cracks by 1000x vs MD5.
Directional209-char passwords crack in seconds with wordlists.
Single source2116-char passphrase: 10^30 guesses needed.
Verified22Hybrid attacks guess 10^9 passwords/sec.
Verified2312-char mixed: 550 years crack time est.
VerifiedPassword Strength Interpretation
Here is a one-sentence interpretation:
The collective password security of the internet is a fragile, mostly fictional concept built on the naïve hope that attackers won't bother using the very common tools and obvious shortcuts that can obliterate our pathetic 8-character passwords in seconds.
Security Recommendations
1NIST recommends passwords of at least 8 characters but ideally 12-16 for better entropy.
Verified242% of people use passwords longer than 12 characters post-2022 awareness campaigns.
Verified3Only 26% of organizations enforce password managers.
Verified4Multi-factor authentication reduces password breach risk by 99%.
Directional534% of enterprises still mandate password rotation quarterly.
Single source693% of users know password hygiene but only 40% practice it.
Verified7MFA adoption jumped to 37% in SMBs by 2023.
Verified8Passwordless login reduces risk by 99.9% per Microsoft.
Verified9Zero-knowledge password managers adopted by 28% users.
Directional1056% organizations ban password reuse now per NIST shift.
Single source11Passkeys adopted in 10% of Apple logins by 2024.
Verified12Biweekly password changes harm security per NIST.
Verified1365% enterprises moved to 365-day expiry.
VerifiedSecurity Recommendations Interpretation
Despite widespread knowledge that a strong password is like a good secret—best kept long and unchanged, then protected by a second lock and ideally forgotten entirely—our collective digital hygiene remains a tragicomedy where good intentions are routinely betrayed by laziness, outdated corporate rituals, and the stubborn hope that 'password123' is still a clever insider code.
User Habits
123% of users still use their birth year as part of their password according to a 2022 Google study.
Verified252% of Americans reuse the same password across multiple sites per 2023 Keeper report.
Verified3Users change passwords every 90 days on average in enterprises, but 60% reuse old ones.
Verified468% of users pick passwords based on names of pets or family members.
Directional591% of cybersecurity professionals worry about password reuse.
Single source659% of users admit sharing passwords with family or friends.
Verified7Users check passwords 150 times per month on average via managers.
Verified862% of users never change default router passwords.
Verified9Women use 7.4 avg length passwords, men 7.8 per 2022 study.
Directional1055% of millennials use social media info in passwords.
Single source11Boomers reuse passwords 2.1x more than Gen Z.
Verified1249% of users write down passwords due to forgetting.
Verified13Teens use emojis in 18% of passwords, weakening them.
Verified1472% of employees share passwords with colleagues.
Directional1541% use birthday in password, easy for social engineering.
Single source16Average user has 100+ passwords to manage.
Verified1763% forget password weekly, triggering resets.
Verified1878% SMBs lack password policy enforcement.
Verified19Gen Z uses 9.2 avg length, better than avg.
Directional2029% use same password everywhere knowingly.
Single source2151% store passwords in browsers unsafely.
Verified22Elderly (65+) use weakest passwords, avg 7 chars.
Verified23Remote workers reuse 3x more passwords.
VerifiedUser Habits Interpretation
Despite living in an age where we can summon food with a phone and store our lives in the cloud, the human password strategy remains a tragically predictable and communal affair, as if we’re still protecting a treehouse with a secret word that is, invariably, someone’s birthday.
Sources & References
- Reference 1VERIZONverizon.comVisit source
- Reference 2HAVEIBEENPWNEDhaveibeenpwned.comVisit source
- Reference 3SPLASHDATAsplashdata.comVisit source
- Reference 4BLOGblog.googleVisit source
- Reference 5NORDPASSnordpass.comVisit source
- Reference 6PAGESpages.nist.govVisit source
- Reference 7KEEPERSECURITYkeepersecurity.comVisit source
- Reference 8IBMibm.comVisit source
- Reference 9LASTPASSlastpass.comVisit source
- Reference 10SPECOPSSOFTspecopssoft.comVisit source
- Reference 11MICROSOFTmicrosoft.comVisit source
- Reference 12HIVE-SYSTEMShive-systems.comVisit source
- Reference 13STRONGDMstrongdm.comVisit source
- Reference 14HACKTHEBOXhackthebox.comVisit source
- Reference 15OKTAokta.comVisit source
- Reference 16RESEARCHresearch.checkpoint.comVisit source
- Reference 171PASSWORD1password.comVisit source
- Reference 18PASSWORD-HACKINGpassword-hacking.comVisit source
- Reference 19PONEMONponemon.orgVisit source
- Reference 20UPGUARDupguard.comVisit source
- Reference 21XKCDxkcd.comVisit source
- Reference 22GRCgrc.comVisit source
- Reference 23NORTONnorton.comVisit source
- Reference 24TROYHUNTtroyhunt.comVisit source
- Reference 25RAPID7rapid7.comVisit source
- Reference 26WORLDworld.std.comVisit source
- Reference 27NSPLOOKUPnsplookup.comVisit source
- Reference 28CYBERNEWScybernews.comVisit source
- Reference 29HASHCAThashcat.netVisit source
- Reference 30TEAMBLINDteamblind.comVisit source
- Reference 31BITWARDENbitwarden.comVisit source
- Reference 32USENIXusenix.orgVisit source
- Reference 33DROHdroh.id digestsVisit source
- Reference 34DASHLANEdashlane.comVisit source
- Reference 35KALIkali.orgVisit source
- Reference 36PASSWORDMETERpasswordmeter.comVisit source
- Reference 37SECURITYsecurity.apple.comVisit source
- Reference 38ARGON2argon2.comVisit source
- Reference 39CRACKSTATIONcrackstation.netVisit source
- Reference 40CORRECTHORSEBATTERYSTAPLEcorrecthorsebatterystaple.netVisit source
- Reference 41NVLPUBSnvlpubs.nist.govVisit source
- Reference 42OPENWALLopenwall.comVisit source
- Reference 43ZDNETzdnet.comVisit source