Historical background
The folks at Duo Security were nice enough to post the top 250 passwords from the cracking of over 200,000 DES password hashes from the recent Gawker Media hack from November of 2010.
I compared the recent list of top 250 passwords from Duo Security with the older famous password.lst dictionary distributed by Openwall Project. The 3169 entry password.lst dictionary is best known for being distributed with John the Ripper password cracker, also known as JTR.
Openwall Project describes their common password dictionary as being “based on passwords most commonly seen on a set of Unix systems in mid-1990’s, sorted for decreasing number of occurrences (that is, more common passwords are listed first). It has been revised to also include common website passwords from public lists of ‘top N passwords’ from major community website compromises that occurred in 2006 through 2009.”
With new data from the accidental Gawker Media exposure of over 740,000 password hashes, we can update the list of the most common passwords and also do statistical analysis on the change in popularity of the most commonly used passwords.
Excluding anomalous words
The following passwords were removed from the list, because of their likely relevance only to the Gawker Media blog sites “The Consumerist”, “Gizmodo”, “Gawker”, “Kotaku”, “Deadspin”, and “Jezebel”.
| Rank | Password |
|---|---|
| 9 | consumer |
| 15 | gizmodo |
| 28 | gawker |
| 40 | kotaku |
| 62 | valleywa |
| 66 | deadspin |
| 87 | jezebel |
| 115 | gizmodo1 |
If you are trying to crack passwords for a specific site from a hash list, it is obviously important to add the name of the site to your password dictionary.
Since the new Gawker Media password list was extracted from DES hashes, limiting results to the first 8 significant characters, we also matched up obviously truncated 8 character passwords from the new list to longer words in the older password.lst dictionary.
| Raw | Corrected |
|---|---|
| swordfis | swordfish |
| elizabet | elizabeth |
| butterfl | butterfly |
| liverpoo | liverpool |
| alexande | alexander |
| basketba | basketball |
Popularity rank historical changes
This list shows the change in rank of the most popular 250 passwords from Duo Security’s dictionary list, sorted by difference/change in rank.
| Password | New Rank | Old Rank | Diff |
|---|---|---|---|
| 1qaz2wsx | 74 | — | NEW |
| redsox | 86 | — | NEW |
| spiderma | 87 | — | NEW |
| simpsons | 117 | — | NEW |
| monster | 121 | — | NEW |
| november | 130 | — | NEW |
| drowssap | 131 | — | NEW |
| monkey12 | 134 | — | NEW |
| brooklyn | 138 | — | NEW |
| wordpass | 143 | — | NEW |
| Highlife | 149 | — | NEW |
| poopoo | 150 | — | NEW |
| q1w2e3r4 | 160 | — | NEW |
| coolness | 162 | — | NEW |
| gundam | 168 | — | NEW |
| darkness | 178 | — | NEW |
| sample12 | 185 | — | NEW |
| slipknot | 216 | — | NEW |
| 159753 | 222 | — | NEW |
| 11235813 | 225 | — | NEW |
| pineappl | 227 | — | NEW |
| jackass | 229 | — | NEW |
| chester | 231 | — | NEW |
| somethin | 235 | — | NEW |
| 1q2w3e4r | 44 | 3153 | -3109 |
| blahblah | 27 | 3133 | -3106 |
| passw0rd | 35 | 3138 | -3103 |
| pokemon | 47 | 3126 | -3079 |
| 123qwe | 77 | 3136 | -3059 |
| poop | 103 | 3131 | -3028 |
| 114 | 3139 | -3025 | |
| qazwsx | 123 | 3125 | -3002 |
| babygirl | 115 | 3112 | -2997 |
| blink182 | 164 | 3135 | -2971 |
| hahaha | 198 | 3130 | -2932 |
| 112233 | 238 | 3157 | -2919 |
| 222222 | 233 | 3148 | -2915 |
| naruto | 203 | 3118 | -2915 |
| chocolat | 109 | 2988 | -2879 |
| asshole | 91 | 2964 | -2873 |
| 121212 | 106 | 2922 | -2816 |
| swordfish | 65 | 2760 | -2695 |
| voodoo | 192 | 2864 | -2672 |
| whocares | 226 | 2884 | -2658 |
| qwerty12 | 63 | 2549 | -2486 |
| qwertyui | 94 | 2550 | -2456 |
| scooby | 202 | 2637 | -2435 |
| nintendo | 28 | 2442 | -2414 |
| gateway | 119 | 2073 | -1954 |
| hello123 | 197 | 2148 | -1951 |
| december | 187 | 1937 | -1750 |
| corvette | 188 | 1900 | -1712 |
| butterfly | 137 | 1815 | -1678 |
| asdf1234 | 92 | 1704 | -1612 |
| Password | 42 | 1595 | -1553 |
| 000000 | 29 | 1457 | -1428 |
| yankees | 71 | 1446 | -1375 |
| 123321 | 98 | 1464 | -1366 |
| 7777777 | 174 | 1512 | -1338 |
| 88888888 | 183 | 1515 | -1332 |
| 11111111 | 208 | 1460 | -1252 |
| thunder | 175 | 1398 | -1223 |
| turtle | 193 | 1416 | -1223 |
| tucker | 223 | 1415 | -1192 |
| spider | 194 | 1366 | -1172 |
| midnight | 76 | 1214 | -1138 |
| jackson | 95 | 1127 | -1032 |
| hannah | 72 | 1102 | -1030 |
| liverpool | 152 | 1175 | -1023 |
| maxwell | 205 | 1203 | -998 |
| asdfasdf | 32 | 918 | -886 |
| danielle | 172 | 1026 | -854 |
| asdfghjk | 73 | 920 | -847 |
| banana | 80 | 927 | -847 |
| creative | 182 | 1016 | -834 |
| bailey | 113 | 926 | -813 |
| chicago | 199 | 993 | -794 |
| starwars | 20 | 800 | -780 |
| bullshit | 211 | 967 | -756 |
| 1111 | 129 | 859 | -730 |
| abcd1234 | 180 | 892 | -712 |
| yellow | 158 | 849 | -691 |
| samantha | 100 | 775 | -675 |
| stupid | 154 | 806 | -652 |
| remember | 118 | 763 | -645 |
| nicole | 97 | 731 | -634 |
| snickers | 176 | 792 | -616 |
| winston | 234 | 843 | -609 |
| metallic | 111 | 709 | -598 |
| fuckoff | 61 | 625 | -564 |
| cheese | 23 | 577 | -554 |
| guitar | 122 | 645 | -523 |
| mercedes | 204 | 707 | -503 |
| nicholas | 228 | 730 | -502 |
| 1234567 | 16 | 517 | -501 |
| london | 195 | 690 | -495 |
| 123123 | 24 | 516 | -492 |
| jasmine | 171 | 661 | -490 |
| elizabeth | 128 | 610 | -482 |
| godzilla | 186 | 636 | -450 |
| compaq | 156 | 584 | -428 |
| bubbles | 132 | 560 | -428 |
| fluffy | 206 | 617 | -411 |
| goober | 230 | 639 | -409 |
| adidas | 140 | 535 | -395 |
| boston | 179 | 556 | -377 |
| austin | 200 | 541 | -341 |
| superman | 15 | 337 | -322 |
| snowball | 166 | 480 | -314 |
| cookie | 75 | 377 | -302 |
| princess | 22 | 317 | -295 |
| 696969 | 241 | 520 | -279 |
| nothing | 60 | 310 | -250 |
| killer | 48 | 296 | -248 |
| penguin | 209 | 453 | -244 |
| purple | 79 | 320 | -241 |
| rosebud | 239 | 468 | -229 |
| 654321 | 31 | 251 | -220 |
| matrix | 81 | 301 | -220 |
| martin | 224 | 439 | -215 |
| peanut | 99 | 313 | -214 |
| 666666 | 39 | 252 | -213 |
| cocacola | 163 | 374 | -211 |
| hunter | 83 | 287 | -204 |
| startrek | 133 | 333 | -200 |
| asdf | 67 | 261 | -194 |
| oliver | 120 | 311 | -191 |
| zxcvbnm | 165 | 348 | -183 |
| flower | 214 | 395 | -181 |
| eagles | 207 | 384 | -177 |
| ferrari | 215 | 391 | -176 |
| booger | 102 | 264 | -162 |
| morgan | 145 | 307 | -162 |
| william | 93 | 248 | -155 |
| maverick | 147 | 302 | -155 |
| 111111 | 8 | 157 | -149 |
| smokey | 184 | 332 | -148 |
| lauren | 153 | 298 | -145 |
| ginger | 54 | 197 | -143 |
| 1q2w3e | 112 | 250 | -138 |
| pumpkin | 181 | 319 | -138 |
| phoenix | 88 | 226 | -138 |
| apples | 221 | 357 | -136 |
| charlie | 58 | 180 | -122 |
| steelers | 212 | 334 | -122 |
| chicken | 59 | 181 | -122 |
| welcome | 40 | 155 | -115 |
| jessica | 90 | 204 | -114 |
| daniel | 82 | 187 | -105 |
| whatever | 14 | 119 | -105 |
| aaaaaa | 56 | 159 | -103 |
| sunshine | 17 | 116 | -99 |
| orange | 52 | 144 | -92 |
| monkey | 7 | 98 | -91 |
| madison | 125 | 214 | -89 |
| justin | 127 | 208 | -81 |
| jasper | 213 | 291 | -78 |
| biteme | 51 | 129 | -78 |
| sophie | 159 | 235 | -76 |
| popcorn | 243 | 316 | -73 |
| iloveyou | 18 | 90 | -72 |
| scooter | 78 | 149 | -71 |
| nirvana | 151 | 221 | -70 |
| pepper | 37 | 103 | -66 |
| booboo | 110 | 174 | -64 |
| master | 33 | 95 | -62 |
| football | 26 | 87 | -61 |
| ashley | 107 | 168 | -61 |
| jennifer | 38 | 91 | -53 |
| joshua | 89 | 141 | -52 |
| 12345678 | 3 | 55 | -52 |
| soccer | 30 | 75 | -45 |
| elephant | 148 | 191 | -43 |
| silver | 108 | 151 | -43 |
| foobar | 96 | 138 | -42 |
| trustno1 | 12 | 54 | -42 |
| tennis | 201 | 242 | -41 |
| anthony | 126 | 166 | -40 |
| batman | 43 | 81 | -38 |
| fucker | 161 | 196 | -35 |
| taylor | 124 | 154 | -30 |
| fuckyou | 19 | 49 | -30 |
| dragon | 11 | 36 | -25 |
| george | 64 | 88 | -24 |
| letmein | 9 | 30 | -21 |
| baseball | 13 | 26 | -13 |
| thx1138 | 105 | 117 | -12 |
| asdfgh | 69 | 79 | -10 |
| muffin | 210 | 217 | -7 |
| qwerty | 4 | 9 | -5 |
| shadow | 21 | 25 | -4 |
| 123456 | 1 | 5 | -4 |
| michael | 34 | 38 | -4 |
| password | 2 | 3 | -1 |
| abc123 | 5 | 2 | +3 |
| 1234 | 10 | 7 | +3 |
| basketball | 173 | 170 | +3 |
| 12345 | 6 | 1 | +5 |
| andrew | 49 | 43 | +6 |
| buster | 41 | 35 | +6 |
| alexander | 169 | 163 | +6 |
| michelle | 46 | 39 | +7 |
| shithead | 242 | 233 | +9 |
| brandon | 189 | 176 | +13 |
| joseph | 219 | 206 | +13 |
| hello | 36 | 23 | +13 |
| maggie | 45 | 31 | +14 |
| amanda | 139 | 124 | +15 |
| jordan | 53 | 37 | +16 |
| matthew | 68 | 50 | +18 |
| freedom | 84 | 65 | +19 |
| computer | 25 | 4 | +21 |
| boomer | 157 | 130 | +27 |
| internet | 50 | 19 | +31 |
| sparky | 144 | 112 | +32 |
| mustang | 70 | 33 | +37 |
| thomas | 116 | 76 | +40 |
| 123 | 55 | 10 | +45 |
| summer | 66 | 18 | +48 |
| love | 142 | 93 | +49 |
| tigger | 57 | 6 | +51 |
| dakota | 237 | 185 | +52 |
| dallas | 240 | 186 | +54 |
| rachel | 170 | 108 | +62 |
| secret | 85 | 17 | +68 |
| coffee | 136 | 62 | +74 |
| merlin | 146 | 72 | +74 |
| hockey | 104 | 29 | +75 |
| mickey | 101 | 16 | +85 |
| diamond | 135 | 47 | +88 |
| please | 236 | 145 | +91 |
| chelsea | 155 | 61 | +94 |
| jonathan | 196 | 92 | +104 |
| bandit | 190 | 80 | +110 |
| 8675309 | 232 | 122 | +110 |
| pookie | 217 | 106 | +111 |
| test | 141 | 13 | +128 |
| snoopy | 167 | 34 | +133 |
| patrick | 177 | 41 | +136 |
| 123abc | 191 | 42 | +149 |
| calvin | 220 | 45 | +175 |
Pop culture changes
Some of the most most interesting changes in ranking are the new words on the list and the huge rank increases of others, due to recent pop culture.
Movies: “Spiderman” (2002), “Swordfish” (2001), “The Simpsons Movie” (2007), “12 Monkeys” (1995), “Jackass : The Movie” (2002), “Pokemon: The First Movie” (1998), “Naruto: Shippūden: the Movie” (2007), “Mobile Suit Zeta Gundam” (Rerelease 2005)
TV Shows: “Simpsons” (1989), “Jackass” (2000), “The Amazing Spider-Man” (1977), “Spider-Man and His Amazing Friends” (1981), “Naruto” (2002), “Pokemon” (1998)
Although some of these properties appeared on TV earlier than the older password.lst dictionary, it’s obvious that the movies later brought them more popularity.
Bands: Slipknot (1999)
Sports Teams: Redsox, Yankees.
Unfortunately, our old print cartoons have suffered a huge drop in popularity. I wonder if new generations will even be introduced to Snoopy and “Calvin and Hobbes“.
Other trends
Oddly, the results show that “1q2w3e4r” and “blahblah” are the most recently popular passwords used. It’s hard to pinpoint the reason why “blahblah”, or drawing a zig zag on the keyboard to spell “1q2w3e4r” would suddenly become popular. At least new passwords like “1q2w3e4r”, “drowssap”, “wordpass”, and “passw0rd” are showing a bit more creativity than old time favorites “12345678” and “qwerty”, which unfortunately have still increased in popularity.
However, less surprising is the increase in popularity of the word “google”.