Password Statistics 2026: 92% of the “Strong” Passwords We Built to Pass Complexity Rules Were Already Breached

The pages that rank for “password statistics” today are mostly vendor roundups of third-party survey numbers. This page measures something directly: it takes the rules most companies still enforce, constructs the passwords those rules produce, and counts how many are already sitting in breach dumps. Every number below is a count we computed, with the method shown. NIST’s current standard, SP 800-63B Revision 4, now tells verifiers to stop requiring character mixtures and to check new passwords against exactly this kind of blocklist instead.

The bench

Each experiment below states a hypothesis, the method (the candidate set), and the result. The breach counts come from the Pwned Passwords range API: for a given string, the API returns how many times its hash appears across the breaches Have I Been Pwned has ingested. A count of 0 means the string was not found. We never submit a full hash or a real password; only the first five characters of each SHA-1 hash leave the machine.

Why the breach corpus still matters even as breaches expose fewer passwords

A companion analysis of Have I Been Pwned found that passwords now appear in only 19% of breaches added in 2026, down from 86% in 2016 to 2019. Fewer new password dumps do not retire the old ones: every entry in Experiment 1 is still in the corpus and still on the wordlists anyone can download. Logins remain a working way in. When we coded CISA’s #StopRansomware advisories by entry technique, valid accounts (MITRE ATT&CK T1078) appeared in 10 of the 22 advisories that published initial access tables, and 7 of those 10 also listed external remote services such as VPN or remote desktop, according to our analysis of ransomware initial access vectors. The other main route, exploiting internet-facing devices, is tracked in our analysis of the CISA known exploited vulnerabilities catalog.

What this means for MSPs and IT teams

Drop composition rules from your policies: a rule that Password1! satisfies gives false assurance, and NIST now prohibits such rules. Follow the current NIST line instead: require length (a 15-character minimum for single-factor secrets), allow long passphrases up to at least 64 characters, stop forcing periodic resets, and screen every new or changed password against a breached-password blocklist at the moment it is set. The Pwned Passwords API used here is free and k-anonymous, so screening can be done without ever sending a client’s password off-site. Pair it with phishing-resistant multi-factor authentication, because a breached password is only dangerous when it is also a sufficient one.

Frequently asked questions

What are the most common passwords in 2026?

In our test of the public SecLists top 10,000 list, the most frequent string was “123456”, which Have I Been Pwned has seen 210,461,208 times across known breaches; “password” ranked 4th with 52,372,427. All 10,000 entries were present in the breach corpus.

Does adding a capital letter, a number and a symbol make a password safe?

No. We built 634 passwords that satisfy a typical complexity rule (at least 8 characters with an uppercase letter, a lowercase letter, a digit and a symbol), using predictable patterns like Season plus Year plus a symbol. 92% of them were already in Have I Been Pwned. Password1! alone appears 584,516 times.

How many passwords did this report test?

We checked 12,674 candidate passwords against the Have I Been Pwned Pwned Passwords API using k-anonymity, so no full password ever left our machine. All candidates came from public lists or obvious patterns; we never queried a real user’s password.

Do random passphrases get breached?

In our control group, 0 of 1,200 randomly generated strings (600 four-word diceware passphrases and 600 random 16-character strings) appeared in the corpus. The method is not flagging everything: only guessable, human-chosen patterns show up.

What does NIST say about password complexity rules?

NIST Special Publication 800-63B Revision 4, published as final in July 2025, says verifiers SHALL NOT impose composition rules such as requiring mixtures of character types, and SHALL NOT require periodic password changes. It does require checking new passwords against a blocklist of known compromised passwords, which is exactly the measurement in this report.

Is appending the year to a password safe?

No. Across common base words plus every year from 1950 to 2026, all 770 combinations were already breached. Decade years since 2000 stand out: “password2020” appears 71,095 times, and “password2026” already appears 58 times.

Methodology

References

1. Have I Been Pwned, Pwned Passwords and range API. Accessed October 2026.
2. NIST SP 800-63B Revision 4, Digital Identity Guidelines: Authentication and Authenticator Management, July 2025. Accessed October 2026.
3. NIST CSRC, SP 800-63B-4 publication record (final, July 31, 2025). Accessed October 2026.
4. SecLists, 10k-most-common.txt (Daniel Miessler, MIT license). Accessed October 2026.
5. Electronic Frontier Foundation, large diceware wordlist. Accessed October 2026.