Password Security Statistics 2024
The most important password security statistics, data breaches facts, and cybersecurity trends — all sourced from published research by Google, IBM, Verizon, NordPass, and others.
24B
Passwords on dark web
82%
Breaches from weak passwords
$4.45M
Average breach cost
99.9%
Attacks blocked by MFA
Password Habits
65%
of people reuse the same password across multiple accounts
Google / Harris Poll, 2019
13%
of people use the same password for all of their accounts
Google / Harris Poll, 2019
52%
of people reuse passwords for multiple but not all accounts
Dashlane, 2023
82%
of data breaches involve stolen or weak passwords
Verizon DBIR, 2023
45%
of people haven't changed their passwords in the past year
LastPass, 2022
24%
of Americans have used generic passwords like 'abc123' or '123456'
Google / Harris Poll, 2019
Password Strength
8 chars
is the most common password length among users globally
Specops, 2023
88%
of passwords used in attacks are 12 characters or fewer
Specops, 2023
18.8M
commonly used passwords can be cracked in under a second
NordPass, 2023
200+
most popular passwords are variations of 'password'
NordPass, 2023
4.7B
passwords were leaked in the Collection #1-5 breaches alone
Have I Been Pwned, 2019
3 sec
is all it takes to crack a password like 'Passw0rd!'
Cybernews, 2023
Data Breaches
24B
username and password combinations circulating on the dark web in 2022
Digital Shadows, 2022
$4.45M
average cost of a data breach in 2023 (all-time high)
IBM Cost of a Data Breach, 2023
83%
of organizations experienced more than one breach in 2023
IBM, 2023
207 days
average time to identify a data breach
IBM Cost of a Data Breach, 2023
19%
of breaches were caused by stolen or compromised credentials
Verizon DBIR, 2023
3.4B
phishing emails sent daily — many stealing passwords directly
Cisco, 2023
Password Manager Adoption
34%
of people use a password manager as their primary method to track passwords
LastPass, 2022
79%
of people feel confident their passwords are secure when using a manager
LastPass, 2022
70%
of employees still share passwords over email or messaging apps
Keeper Security, 2022
3×
less likely to experience account takeover when using a password manager
Google Research, 2020
100+
average number of online accounts per person requiring unique passwords
NordPass, 2023
25%
of users forget a password at least once per day
LastPass, 2021
Two-Factor Authentication
99.9%
of account compromise attacks blocked by enabling MFA
Microsoft, 2019
28%
of US adults use two-factor authentication regularly
Duo Security, 2022
50%
reduction in phishing success rates when 2FA is enabled
Google, 2019
76%
of security professionals use 2FA for personal accounts
LastPass, 2022
10s
is all it takes to enable 2FA on most major platforms
General best practice
89%
of enterprise companies now require MFA for critical systems
Okta, 2023
Most Common Passwords (2024)
#1
'123456' — used by over 3 million accounts in breaches
NordPass, 2024
#2
'password' — unchanged in the top 5 for over a decade
NordPass, 2024
#3
'123456789' — takes less than 1 second to crack
NordPass, 2024
#4
'12345678' — found in hundreds of millions of leaked databases
NordPass, 2024
#5
'qwerty123' — keyboard walks are the third most common pattern
NordPass, 2024
#6
'iloveyou' — emotional passwords are consistently in the top 10
NordPass, 2024
Key Takeaways
- 1Over 80% of breaches involve stolen or weak passwords — yet most people still reuse passwords across accounts.
- 2Enabling multi-factor authentication blocks 99.9% of automated account attacks — it's the single most impactful security action you can take.
- 3A password manager eliminates the reuse problem entirely. The average person has 100+ accounts; no human can memorize 100 unique strong passwords.
- 4Password length matters more than complexity. A 16-character random password is exponentially harder to crack than an 8-character 'complex' one.
- 5The average breach takes 207 days to detect — meaning a stolen password can be used against you for months before you know.
Take Action Now
Statistics sourced from published research by Google, IBM, Verizon, NordPass, LastPass, Dashlane, Microsoft, and others. Data reflects findings available as of 2023–2024. Individual study methodologies may vary.