Nearly half of the world’s passwords can be cracked in under a minute | Kaspersky official blog
Solutions for:
Home
Security Solutions
Kaspersky Premium<br>Kaspersky Plus<br>Kaspersky Standard<br>View All Solutions<br>Privacy & Kids
Kaspersky Safe Kids<br>Kaspersky VPN Secure Connection<br>Kaspersky Password Manager
Renew Licence<br>Support<br>Trials&Update
Business
Kaspersky Next<br>Small Business (1-50 employees)<br>Medium Business (51-999 employees)<br>Enterprise (1000+ employees)
Search blog posts<br>Blog
Business
News
Privacy
Products
Special Projects
Technology
Threats
Tips
RSS
About us
About company<br>Transparency<br>Corporate News<br>Press Center<br>Careers<br>Sponsorships<br>Policy blog<br>Contacts
Partners
Find a Partner<br>Partners
My Account
Personal
My Kaspersky<br>Renew your product
Business
KSOS portal<br>Kaspersky Business Hub<br>Renew your License
Search
Every year, hundreds of millions of real user passwords leak onto the dark web. We analyzed 231 million unique passwords from dark-web leaks between 2023 and 2026, and the conclusions are bleak: the vast majority are extremely weak. To crack 60% of these passwords, a hacker needs only an hour and a few dollars in their pocket. Furthermore, password cracking is accelerating by the year; in our similar 2024 study, the percentage of vulnerable passwords was lower.
Today we’re looking at just how reliable the average password is (spoiler: not really), and how you can secure your data and accounts using more robust methods. At the same time, we’ll highlight the patterns most commonly found in actual user passwords.
How passwords are cracked
In our previous study, we detailed the methods for storing and cracking passwords, but here’s a quick refresher on the essentials.
These days, passwords are almost never stored in plain text. For instance, if you create an account with the password “Password123!”, the server won’t store it as-is. Instead, the password is hashed using specific algorithms, turning it into a fixed-length string of letters and numbers (a hash) which is what actually stays on the server. For example, here’s what the MD5 hash for “Password123!” looks like:
2c103f2c4ed1e59c0b4e2e01821770fa.
Every time the user enters their password, it’s converted into a hash and compared against the one stored on the server; if the hashes match, the password is correct. If an attacker gets their hands on this hash, they have to decrypt it to recover the original password — this is what’s known as “password cracking”. This is typically done using owned or rented GPUs, and several methods can be employed for the crack:
Exhaustive enumeration (brute force) . The computer tries every possible combination of characters, calculating the hash for each one. This method is the easiest way to crack short passwords, or those consisting of a single character set (such as digits only).
Rainbow tables . A total nightmare for anyone with a simple password, this is essentially a “phone book” for passwords whose hashes have already been cracked via brute force or smart algorithms. All an attacker has to do is find a matching hash and see which password corresponds to it.
Smart cracking . These algorithms are trained on databases of leaked passwords. They understand the frequency of different character combinations, and run their checks from the most likely to the least popular sequences. They account for dictionary words, character substitutions (a → @ or s → $), and consider common password structures like “dictionary word + number + special character”, while checking hashes against rainbow tables. Combining these methods significantly accelerates the cracking process.
Beyond that, attackers can also intercept passwords in plain text. There are numerous ways to do this, ranging from phishing (where a victim is lured to a fake web page and enters their password voluntarily) and keyloggers that capture keystrokes, to stealers or Trojans that swipe documents, cookies, clipboard data, and more. Unfortunately, many users keep their passwords as plain text in notes, messaging apps, and documents, or save them in browsers where attackers can extract them in seconds.
Every year, we track around a hundred million plain-text password leaks. We use these databases to warn Kaspersky Password Manager users if their data has been compromised. To address the most frequent question we get on this: no, we don’t know our users’ passwords. We’ve explained in non-techie language exactly how we compare your passwords to leaked ones without actually knowing them — and why neither your passwords stored in Kaspersky Password Managernor even their hashes ever leave your device — in our overviews of our leak analysis technology and our password manager’s internal architecture. Give them a read; you’ll be surprised by just how elegant the design is.
60% of passwords are cracked in under an hour
We expanded the database from our previous study by an additional 38 million real passwords posted by attackers on...