The numbers
Take the hundred thousand most common passwords in the breach corpus. Between them they account for 46.7% of every choice counted in the top million. Ten percent of the passwords, nearly half of the choices.
That is the whole reason dictionary attacks work, and it is why the two columns below are more interesting together than either is alone. The same measurement, run twice, cut at a different depth.
| Top 100,000 | Top 1,000,000 | |
|---|---|---|
| Contains a digit | 66.0% | 77.0% |
| Contains a capital letter | 18.9% | 28.6% |
| Contains a symbol | 7.5% | 11.6% |
| Lowercase letters only | 31.7% | 20.9% |
| Digits only | 18.1% | 14.2% |
| 6.35 billion and 13.59 billion choices respectively — not individuals: the same person counts once per leaked site. | ||
Every figure moves the same way. Go deeper into the ranking and passwords get longer, mixed-case, more likely to carry a symbol. Which is the expected shape once you say it out loud: the most common passwords are the simplest ones, by definition. Complexity is not absent from the world. It is absent from the top, and the top is where the choices are.
So a number like “7.5% contain a symbol” is not a fact about passwords. It is a fact about a set, and the set has to be named or the number means nothing. That is why both columns are here instead of the flattering one.
The suffix is the whole trick
Across the top million, 1 and 123 alone account for 11.5% of everything
counted — 1.57 billion choices between two strings. Widen it to the seven most common endings and
you are at 17.5%.
This is what an attack actually looks like. Not every combination in order: a list of ordinary words, and a
short list of the things people put after them. @123 sits fifth with 180 million choices, which
is the shape a corporate policy leaves behind — one capital, one symbol, some digits, requirement met.
Length
56% of the top million's choices sit at eight characters or fewer, and eight alone accounts for 28% — the single most common length, and not by accident. It is the number the rule asks for, so it is the number people produce. Asked for a minimum, they hand back a maximum.
What the number actually counts
Pwned Passwords records, for every password, how many times that exact string was chosen across the breaches it has ingested. That is a count of choices, and it is not a headcount — in three ways, all pushing the same direction.
One person who chose the same password on four sites that all leaked contributes four. A single dump that circulated inside several later collections can be counted more than once. And plenty of what is in there was never a person at all: test registrations, automation, abandoned sign-ups.
So the figure overstates individuals, and there is no honest way to say by how much, because the corpus deliberately holds no identities to deduplicate against. Pulling the other way, and far more weakly, anyone who chose a password only on sites that never leaked is invisible here.
None of this damages the comparisons on this page, which is the reason to be plain about it rather than quiet: every column was measured the same way, so the differences between them hold. What you should not do is read a single number as a count of human beings. Read it as how worn a password is.
How this was measured, and what it misses
Every password in the Pwned Passwords corpus is stored as a hash, so a plain-text wordlist was hashed and
matched against it to recover both the strings and their counts. Nothing was filtered out except lines that are
not passwords at all — dump artifacts like [NOT_SAVED] and undefined, which are
placeholders a broken form wrote, and which together carried 67 million counts that would otherwise have been
read as choices.
The wordlist matched 97.4% of the top hundred thousand and 97.8% of the top million, so the gap between the columns is a real difference and not an artifact of coverage. What stays invisible is anything the wordlist never contained, which skews toward the unusual — meaning the true figures are, if anything, slightly less bleak than these.
Both result files are in the repository. The numbers here can be recomputed from them, or from scratch against the same snapshot.
What the game draws from
Separate from everything above, and not statistics about real-world passwords. The playable set is 2,022 passwords built on 1,190 distinct roots, 1,184 of which have a full variant ranking behind them. They are filtered so the puzzle can be solved rather than guessed: at least eight characters, a real dictionary word at the root, no keyboard runs, any letters outside the root spelling words too, and no family used more than four times. The set is then balanced by shape, so the most common one doesn't take every other day: a word followed by 1 or 123 makes up about a quarter of it, a word followed by up to three digits about 40%. It describes what the game is allowed to pick, and nothing about the world.
Where the numbers come from
Have I Been Pwned — Pwned Passwords, from a snapshot taken on 2026-08-30. Counts keep growing, so the date is stated rather than chased: naming it is what makes the number checkable instead of decorative.
You can look up your own password there without handing it over. Only the first five characters of its SHA-1 hash are sent, and everything that comes back is compared inside your browser. It is a good habit, and a tidy demonstration of an idea worth knowing: a question about a secret can be answered without the secret ever being sent.
The password list ships with this page
No server decides the puzzle. The whole list sits in your browser, obfuscated but not encrypted in any sense that would hold: anyone who reads the source can work out tomorrow's puzzle. I would rather say so than have you discover it, because it is the first lesson of the subject — a secret kept on the client is not a secret.
What this is not
Daily security puzzles are not a new idea, and this one does not pretend to be one. What it does that the others do not is use real passwords, with the real count of how often they turn up in the breach data. That is the only claim being made here.