Password popularity: a historical analysis

Historical background

The folks at Duo Security were nice enough to post the top 250 passwords from the cracking of over 200,000 DES password hashes from the recent Gawker Media hack from November of 2010.

I compared the recent list of top 250 passwords from Duo Security with the older famous password.lst dictionary distributed by Openwall Project. The 3169 entry password.lst dictionary is best known for being distributed with John the Ripper password cracker, also known as JTR.

Openwall Project describes their common password dictionary as being “based on passwords most commonly seen on a set of Unix systems in mid-1990’s, sorted for decreasing number of occurrences (that is, more common passwords are listed first). It has been revised to also include common website passwords from public lists of ‘top N passwords’ from major community website compromises that occurred in 2006 through 2009.”

With new data from the accidental Gawker Media exposure of over 740,000 password hashes, we can update the list of the most common passwords and also do statistical analysis on the change in popularity of the most commonly used passwords.

Excluding anomalous words

The following passwords were removed from the list, because of their likely relevance only to the Gawker Media blog sites “The Consumerist”, “Gizmodo”, “Gawker”, “Kotaku”, “Deadspin”, and “Jezebel”.

Rank Password
9 consumer
15 gizmodo
28 gawker
40 kotaku
62 valleywa
66 deadspin
87 jezebel
115 gizmodo1

If you are trying to crack passwords for a specific site from a hash list, it is obviously important to add the name of the site to your password dictionary.

Since the new Gawker Media password list was extracted from DES hashes, limiting results to the first 8 significant characters, we also matched up obviously truncated 8 character passwords from the new list to longer words in the older password.lst dictionary.

Raw Corrected
swordfis swordfish
elizabet elizabeth
butterfl butterfly
liverpoo liverpool
alexande alexander
basketba basketball

Popularity rank historical changes

This list shows the change in rank of the most popular 250 passwords from Duo Security’s dictionary list, sorted by difference/change in rank.

Password New Rank Old Rank Diff
1qaz2wsx 74 NEW
redsox 86 NEW
spiderma 87 NEW
simpsons 117 NEW
monster 121 NEW
november 130 NEW
drowssap 131 NEW
monkey12 134 NEW
brooklyn 138 NEW
wordpass 143 NEW
Highlife 149 NEW
poopoo 150 NEW
q1w2e3r4 160 NEW
coolness 162 NEW
gundam 168 NEW
darkness 178 NEW
sample12 185 NEW
slipknot 216 NEW
159753 222 NEW
11235813 225 NEW
pineappl 227 NEW
jackass 229 NEW
chester 231 NEW
somethin 235 NEW
1q2w3e4r 44 3153 -3109
blahblah 27 3133 -3106
passw0rd 35 3138 -3103
pokemon 47 3126 -3079
123qwe 77 3136 -3059
poop 103 3131 -3028
google 114 3139 -3025
qazwsx 123 3125 -3002
babygirl 115 3112 -2997
blink182 164 3135 -2971
hahaha 198 3130 -2932
112233 238 3157 -2919
222222 233 3148 -2915
naruto 203 3118 -2915
chocolat 109 2988 -2879
asshole 91 2964 -2873
121212 106 2922 -2816
swordfish 65 2760 -2695
voodoo 192 2864 -2672
whocares 226 2884 -2658
qwerty12 63 2549 -2486
qwertyui 94 2550 -2456
scooby 202 2637 -2435
nintendo 28 2442 -2414
gateway 119 2073 -1954
hello123 197 2148 -1951
december 187 1937 -1750
corvette 188 1900 -1712
butterfly 137 1815 -1678
asdf1234 92 1704 -1612
Password 42 1595 -1553
000000 29 1457 -1428
yankees 71 1446 -1375
123321 98 1464 -1366
7777777 174 1512 -1338
88888888 183 1515 -1332
11111111 208 1460 -1252
thunder 175 1398 -1223
turtle 193 1416 -1223
tucker 223 1415 -1192
spider 194 1366 -1172
midnight 76 1214 -1138
jackson 95 1127 -1032
hannah 72 1102 -1030
liverpool 152 1175 -1023
maxwell 205 1203 -998
asdfasdf 32 918 -886
danielle 172 1026 -854
asdfghjk 73 920 -847
banana 80 927 -847
creative 182 1016 -834
bailey 113 926 -813
chicago 199 993 -794
starwars 20 800 -780
bullshit 211 967 -756
1111 129 859 -730
abcd1234 180 892 -712
yellow 158 849 -691
samantha 100 775 -675
stupid 154 806 -652
remember 118 763 -645
nicole 97 731 -634
snickers 176 792 -616
winston 234 843 -609
metallic 111 709 -598
fuckoff 61 625 -564
cheese 23 577 -554
guitar 122 645 -523
mercedes 204 707 -503
nicholas 228 730 -502
1234567 16 517 -501
london 195 690 -495
123123 24 516 -492
jasmine 171 661 -490
elizabeth 128 610 -482
godzilla 186 636 -450
compaq 156 584 -428
bubbles 132 560 -428
fluffy 206 617 -411
goober 230 639 -409
adidas 140 535 -395
boston 179 556 -377
austin 200 541 -341
superman 15 337 -322
snowball 166 480 -314
cookie 75 377 -302
princess 22 317 -295
696969 241 520 -279
nothing 60 310 -250
killer 48 296 -248
penguin 209 453 -244
purple 79 320 -241
rosebud 239 468 -229
654321 31 251 -220
matrix 81 301 -220
martin 224 439 -215
peanut 99 313 -214
666666 39 252 -213
cocacola 163 374 -211
hunter 83 287 -204
startrek 133 333 -200
asdf 67 261 -194
oliver 120 311 -191
zxcvbnm 165 348 -183
flower 214 395 -181
eagles 207 384 -177
ferrari 215 391 -176
booger 102 264 -162
morgan 145 307 -162
william 93 248 -155
maverick 147 302 -155
111111 8 157 -149
smokey 184 332 -148
lauren 153 298 -145
ginger 54 197 -143
1q2w3e 112 250 -138
pumpkin 181 319 -138
phoenix 88 226 -138
apples 221 357 -136
charlie 58 180 -122
steelers 212 334 -122
chicken 59 181 -122
welcome 40 155 -115
jessica 90 204 -114
daniel 82 187 -105
whatever 14 119 -105
aaaaaa 56 159 -103
sunshine 17 116 -99
orange 52 144 -92
monkey 7 98 -91
madison 125 214 -89
justin 127 208 -81
jasper 213 291 -78
biteme 51 129 -78
sophie 159 235 -76
popcorn 243 316 -73
iloveyou 18 90 -72
scooter 78 149 -71
nirvana 151 221 -70
pepper 37 103 -66
booboo 110 174 -64
master 33 95 -62
football 26 87 -61
ashley 107 168 -61
jennifer 38 91 -53
joshua 89 141 -52
12345678 3 55 -52
soccer 30 75 -45
elephant 148 191 -43
silver 108 151 -43
foobar 96 138 -42
trustno1 12 54 -42
tennis 201 242 -41
anthony 126 166 -40
batman 43 81 -38
fucker 161 196 -35
taylor 124 154 -30
fuckyou 19 49 -30
dragon 11 36 -25
george 64 88 -24
letmein 9 30 -21
baseball 13 26 -13
thx1138 105 117 -12
asdfgh 69 79 -10
muffin 210 217 -7
qwerty 4 9 -5
shadow 21 25 -4
123456 1 5 -4
michael 34 38 -4
password 2 3 -1
abc123 5 2 +3
1234 10 7 +3
basketball 173 170 +3
12345 6 1 +5
andrew 49 43 +6
buster 41 35 +6
alexander 169 163 +6
michelle 46 39 +7
shithead 242 233 +9
brandon 189 176 +13
joseph 219 206 +13
hello 36 23 +13
maggie 45 31 +14
amanda 139 124 +15
jordan 53 37 +16
matthew 68 50 +18
freedom 84 65 +19
computer 25 4 +21
boomer 157 130 +27
internet 50 19 +31
sparky 144 112 +32
mustang 70 33 +37
thomas 116 76 +40
123 55 10 +45
summer 66 18 +48
love 142 93 +49
tigger 57 6 +51
dakota 237 185 +52
dallas 240 186 +54
rachel 170 108 +62
secret 85 17 +68
coffee 136 62 +74
merlin 146 72 +74
hockey 104 29 +75
mickey 101 16 +85
diamond 135 47 +88
please 236 145 +91
chelsea 155 61 +94
jonathan 196 92 +104
bandit 190 80 +110
8675309 232 122 +110
pookie 217 106 +111
test 141 13 +128
snoopy 167 34 +133
patrick 177 41 +136
123abc 191 42 +149
calvin 220 45 +175

Pop culture changes

Some of the most most interesting changes in ranking are the new words on the list and the huge rank increases of others, due to recent pop culture.

Movies: “Spiderman” (2002), “Swordfish” (2001), “The Simpsons Movie” (2007), “12 Monkeys” (1995), “Jackass : The Movie” (2002), “Pokemon: The First Movie” (1998), “Naruto: Shippūden: the Movie” (2007), “Mobile Suit Zeta Gundam” (Rerelease 2005)

TV Shows: “Simpsons” (1989), “Jackass” (2000), “The Amazing Spider-Man” (1977), “Spider-Man and His Amazing Friends” (1981), “Naruto” (2002), “Pokemon” (1998)

Although some of these properties appeared on TV earlier than the older password.lst dictionary, it’s obvious that the movies later brought them more popularity.

Bands: Slipknot (1999)

Sports Teams: Redsox, Yankees.

Unfortunately, our old print cartoons have suffered a huge drop in popularity. I wonder if new generations will even be introduced to Snoopy and “Calvin and Hobbes“.

Other trends

Oddly, the results show that “1q2w3e4r”  and “blahblah” are the most recently popular passwords used. It’s hard to pinpoint the reason why “blahblah”, or drawing a zig zag on the keyboard to spell “1q2w3e4r” would suddenly become popular. At least new passwords like “1q2w3e4r”, “drowssap”, “wordpass”, and “passw0rd” are showing a bit more creativity than old time favorites “12345678” and “qwerty”, which unfortunately have still increased in popularity.

However, less surprising is the increase in popularity of the word “google”.

Leave a Reply

Your email address will not be published. Required fields are marked *