How passwords are attacked · 4 min read

What makes a password common?

Common passwords are the ones attackers try first. Here is what they look like, measured from a real 10,000-entry list.

A password is “common” when many people independently choose it. That sounds like a popularity contest, but it has a direct security meaning: attackers guess in order of likelihood, so a common password is one that sits near the front of every attacker’s list. Its length and character mix barely matter.

Looking at a real list

This site’s strength checker ships with a list of 10,000 frequently seen passwords, taken from the open SecLists project (“10k most common”, MIT license). It is drawn from leaked password data and ordered from most to least common. Here are its first 20 entries (a few offensive ones are filtered from display):

And here is what the whole list looks like, computed directly from the file:

A few patterns are visible even at a glance.

• Short runs of digits. 123456, 12345678, 1234, 111111. Number sequences are easy to type and easy to remember.
• Keyboard rows. qwerty is the fifth entry. Walks across adjacent keys appear throughout the list; see keyboard patterns and substitutions.
• Ordinary words and names. Sports, animals, first names and words such as dragon, monkey, shadow and master.
• The word “password” itself, which is the list’s first entry.
• Years and dates. People add a birth year or the current year, which puts thousands of passwords into a small band of 4-digit numbers.

Every entry in this list is lowercase. That fits how attackers treat capitals anyway: the same password with a capital first letter, or with a swapped for @, is a cheap variation of the same guess, tried right after it. A checker that wants to be honest has to undo those variations before looking a password up, and this site’s checker does.

Why people converge on the same choices

People choose passwords under constraints: they must remember them, type them on phones, and satisfy whatever rules the site sets. The easiest strategies are shared ones: a familiar word, a name, a meaningful number, a pattern on the keyboard. Composition rules push those strategies toward the same decorations. NIST SP 800-63B-4 gives the standard example: a person who would choose password is “relatively likely to choose ‘Password1’ if required to include an uppercase letter and a number or ‘Password1!’ if a symbol is also required.”

That is why commonness is about how a password was made, not how it looks. Password1! contains four character types and is ten characters long. It is still near the front of the queue.

Worked example: how far the list gets an attacker

Use the site’s illustrative guess rates (assumptions for scale, not measurements):

Online. At 100 guesses per hour, trying all 10,000 entries takes 10,000 ÷ 100 = 100 hours, about 4.2 days, against a single account. But NIST requires services to stop after “no more than 100” consecutive failures by disabling that authenticator. Under that limit, the attacker gets roughly the first 100 entries of their list before the account locks. A password in the top 100 is at real risk even online; a password outside the top few thousand is effectively safe from this particular attack.

Offline, slow hash. At 10,000 guesses per second, the whole 10,000-entry list takes one second per account.

Offline, fast hash. At 10^11 guesses per second, it takes a ten-millionth of a second.

Real attackers’ lists are far longer than 10,000 entries, built from many breaches and expanded with rules (capitalize, add digits, swap letters). The example shows the shape of the problem: commonness collapses the search to almost nothing, whatever the storage.

Blocklists: the standard defense

Because of this, NIST requires verifiers to “compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.” The examples it gives are:

• passwords obtained from previous breach corpuses
• dictionary words
• context-specific words, such as the name of the service, the username, and derivatives thereof

If a password matches, the service “SHALL require the subscriber to select a different secret and SHALL provide the reason for rejection.”

NIST is also clear that a blocklist does not need to be enormous. Its purpose is to stop passwords that would be guessed before the online attempt limit is reached; NIST notes that “excessively large blocklists are of little incremental security benefit” and “will likely frustrate users.” It also says the comparison applies to “the entire password,” not substrings, and asks services to give guidance after a rejection, because otherwise people tend to make trivial changes to the rejected password. The research NIST cites for that point is Habib et al. (2017), linked in the sources.

Common is a property of the source, not the string

A randomly generated password can, in principle, produce something that looks like a word. That is fine: its strength comes from the size of the space it was drawn from, and the chance of landing on a listed entry is negligible. The password generator and passphrase generator compute strength from their settings for exactly this reason.

The reverse is the trap. A password you invented may feel unique and still match a pattern that thousands of others used. You cannot tell from the inside. A checker can only compare it with what is known, which is what this site’s strength checker does, line by line and without sending anything anywhere.

Note: “Not on a common list” does not mean “strong.” A list catches the most obvious choices. A password can be absent from every list and still be guessable with modest effort if it follows a predictable recipe.

Summary

• Common passwords are guessed first, so their length and character variety do not help.
• The most common ones are digit runs, keyboard rows, simple words, names and years.
• Capitals and symbol swaps are variations attackers already try.
• NIST requires services to block common, expected and compromised passwords, and to say why.
• Randomly generated secrets sidestep the problem because they do not come from human habits.

General explanation, not advice for a particular situation. Updated 2026-10-31.