How Fast Passwords Fall

A password is only as good as the time it buys you. The 500 most common ones buy almost none. Every single one on this list falls to an offline attack in under a minute, and 440 of them fall in under one second. The most popular password in the world, the literal word “password,” holds out for all of 2.17 seconds.

Read that chart as a clock, not a bar chart. Each dot is one password, placed by how long it survives an offline cracking rig. The axis is absolute time on a log scale, so a dot one decade to the right lasts ten times longer. The green band is the under-one-second zone, and most of the list lives there. The slowest password on the whole list, “jordan23,” lasts 29.27 seconds.

The data is the 500 most common passwords compiled by Knowledge is Beautiful, distributed through TidyTuesday. Each row carries the password, a category, a strength score, and offline_crack_sec, the seconds to crack it offline. That last column is the one I trust for speed, and it is the one every number here comes from.

Offline is the number that matters

There are two clocks in this dataset, and people quote the wrong one. The online clock assumes an attacker poking at a login form, throttled by the form itself. The offline clock assumes the attacker has already stolen the password database and is grinding hashes on their own hardware, where the rate is many orders of magnitude faster. The first is the optimistic number. The second is what happens after a breach, which is the case you actually need to survive.

On the offline clock, the median password on this list cracks in 3.21 milliseconds. The fastest, an eleven-way tie among things like “1234” and “1111,” crack in 0.11 microseconds. A tenth of a microsecond is no delay at all. The mean is 0.5 seconds, far above the median, because a handful of longer entries carry the average; the slowest of them is a sports password.

Names, before anything else

Sort the 500 by category and one group towers over the rest.

First names lead with 183 of the 500, more than a third of the entire list. Add the next two, “cool-macho” words like “mustang” and “ranger,” and the simple-alphanumeric runs like “123456,” and the top three categories account for 64.6% of everything people pick. The lollipop is baselined at zero, so the length of each stem is the true count and the gap between names and the rest is real.

This is the part that is genuinely human. People do not pick random strings. They pick the first thing that is easy to remember and feels personal, which means a name, their own or someone they love. A cracking dictionary is sorted by exactly this popularity, so what makes a password easy to recall also puts it near the top of a guess list.

Popularity does not predict weakness

I expected the most common passwords to be the weakest, a clean slope from rank 1 down to rank 500. They are not.

Spearman correlation between rank and crack time is -0.04, with a p-value of 0.39: rank and crack time are unrelated. Rank against the dataset’s own strength score is just as flat, at -0.04. The reason is in how the crack times are built. They model brute force, so they depend on length and character set, not on popularity. The eleven fastest entries are four-digit strings at 0.11 microseconds; “password,” eight lowercase letters, takes 2.17 seconds.

That makes these crack times generous. A real attacker holding this list does not brute-force anything: a dictionary attack tries these 500 strings first, so every one of them falls within the first 500 guesses whatever its length. The brute-force clock measures structure. The dictionary measures popularity, and popularity is the vulnerability the brute-force numbers cannot show.

What the numbers can and cannot tell you

This dataset is from 2020, and it covers 500 passwords, not the billions in real breach dumps. The exact crack times come from one brute-force model on hardware of one vintage, so do not read 2.17 seconds as a precision measurement. Read it as an order of magnitude, and the order of magnitude is the point: seconds, not years.

The takeaway is not “make your password longer.” It is that any password a human reaches for unaided is probably already on a list like this one, cracking in well under the time it takes to read this sentence. The only defense the data points to is the one that removes human memory from the loop entirely: a generated string you never have to recall, stored in something that does the remembering for you. The list records what people choose from memory, and every entry cracks in under 30 seconds offline.