Many online accounts still ask for a password. Here are the latest numbers on stolen passwords, password habits, multifactor authentication and passkeys.
Top Password Statistics
-
17.8 billion breached account records are indexed in Have I Been Pwned (October 2026).
-
94% of 19 billion leaked passwords Cybernews analyzed were reused or duplicated (2024–2025).
-
31% of Americans say they have had at least one online account taken over (2026).
-
"123456" was the world's most common password in NordPass' 2025 list.
-
62% of Americans say they often or always reuse a password (2025).
-
Four in 10 Americans use password managers in some fashion (2026).
-
60% of US adults say they use some type of multifactor authentication (2026).
-
An estimated 5 billion passkeys were in use worldwide (May 2026).
Password Breach Statistics
How Often Do Attackers Get In With Stolen Credentials?
Incident response firms record how attackers first got into the networks they investigate.
In Mandiant’s M-Trends, “stolen credentials” means credentials taken from infostealers, exposed databases or code repositories, or dark web forums and leaks, typically where an attack first shows up as a login with valid credentials (Mandiant, M-Trends 2026).
1. 9% of Mandiant’s 2025 investigations found attackers first got in with stolen credentials (Mandiant, M-Trends 2026). That was down from 16% in 2024. The share counts investigations where Mandiant identified how attackers got in.
How Much Do Breaches From Abused Accounts Cost, and How Long Do They Last?
IBM’s yearly study puts a price on data breaches and sorts them by how attackers got in.
2. $5.07 million was the average cost of a breach that began with abusing valid accounts (March 2025–February 2026) (IBM, Cost of a Data Breach Report 2026). The global average for all breaches was a record $4.99 million. IBM studied 602 organizations breached in that period.
3. 179 days was the average time to identify a breach that began with abusing valid accounts (March 2025–February 2026) (IBM, Cost of a Data Breach Report 2026). Containing it took a further 64 days.
How Often Are Online Accounts Hacked or Exposed?
Surveys and crime reports show how often people lose an online account or learn it was exposed.
4. 31% of Americans say they have had at least one online account taken over (2026) (Consumer Reports, 2026 Consumer Cyber Readiness Report). Social media accounts were the most common, at 14%.
Source: Consumer Reports, 2026 Consumer Cyber Readiness Report, p. 8. Share of US adults who have had at least one online account taken over, March–April 2026.
5. 4.7% of Dutch residents aged 15+ had an online account hacked in the past 12 months (2025) (Statistics Netherlands (CBS), Online crime victimisation). Among victims, 16.5% said their password was found out automatically, and 5.6% said it was simply guessed.
6. 41% of US consumers report a confirmed account compromise or breach notification in the past year (2026) (FIDO Alliance, State of Passkeys 2026). Across all 10 countries surveyed, the figure was 33%.
7. Action Fraud recorded 37,884 social media and email hacking offences in England and Wales (year to March 2025) (ONS, Fraud and computer misuse appendix tables). That was up 43.9% from 26,325 a year earlier.
8. About 4,700 account takeover complaints appear in the FBI’s 2025 IC3 report (FBI, 2025 IC3 Annual Report). The report lists $359.7 million in losses from them.
Password Attack Statistics
How Common Are Password and Credential Attacks?
Security companies see these attacks in their own traffic and incident data. The FBI counts the complaints it receives.
In Microsoft’s Digital Defense Report, “password spray” means trying many common passwords at high volume against account details attackers have collected, often with heavy automation, to get into a network (Microsoft, Digital Defense Report 2026).
9. Over 99% of cloud break-in attempts Microsoft observed were password spray attacks (Dec 2025–Jun 2026) (Microsoft, Digital Defense Report 2026).
Source: Microsoft, Digital Defense Report 2026, p. 73. Share of cloud initial access attempts Microsoft observed that were password spray attacks, December 2025–June 2026.
10. Password attacks Microsoft observed fell 26% year over year (July 2025–June 2026) (Microsoft, Digital Defense Report 2026).
11. More than 97% of identity attacks Microsoft flagged in April–June 2025 were password spray or brute force attacks (Microsoft, Digital Defense Report 2025).
12. 85% of usernames Microsoft saw targeted in password spray attacks appeared in known credential leaks (May 2025) (Microsoft, Digital Defense Report 2025). Microsoft checked them against Have I Been Pwned. Each compromised username appeared in three separate logs on average.
13. About 41% of successful human logins on Cloudflare free-plan websites involved leaked passwords (Sep–Nov 2024) (Cloudflare, Password reuse is rampant). Cloudflare matched logins against passwords exposed in known breaches or credential dumps.
14. 95% of login attempts using leaked passwords on Cloudflare free-plan websites came from bots (late 2024) (Cloudflare, Password reuse is rampant).
15. 35% of cloud incidents in CrowdStrike’s 2025 data involved valid account abuse (CrowdStrike, 2026 Global Threat Report).
16. 27.2% of Google Cloud incidents in H2 2025 began with weak or absent credentials (Google Cloud, Cloud Threat Horizons Report H1 2026). That was down from 47.1% in H1 2025. Software exploitation, at 44.5%, overtook credentials as the top way in for the first time.
17. 83% of Mandiant incidents in major cloud and cloud-app environments in H2 2025 began with identity issues (Google Cloud, Cloud Threat Horizons Report H1 2026). Stolen human and non-human identities were the way in for 21% of cases.
In the FBI’s IC3 report, “phishing/spoofing” means unsolicited emails, texts or calls posing as a real company to ask for personal, financial or login details (FBI, 2025 IC3 Annual Report).
18. 191,561 phishing and spoofing complaints were filed with the FBI’s IC3 in 2025 (FBI, 2025 IC3 Annual Report). That was the most of any crime type.
How Long Does It Take to Crack a Password?
Hive Systems estimates how long rented graphics cards would take to crack passwords.
19. 132 years is the maximum time a rented 16-GPU rig needs to crack a random eight-character password using every character type (2026) (Hive Systems, 2026 Password Table). The estimate assumes bcrypt hashing. It was 225 years in 2024 and 164 years in 2025.
20. About three seconds was enough for one rented RTX 5090 to crack a mixed-symbol password when the attacker tried predictable guesses first (2026) (Hive Systems, 2026 Password Table). The test password was protected with bcrypt, a password-hashing method. Hive says this applies to passwords that were stolen before, use real words or are reused.
Leaked Password Statistics
How Many Passwords and Accounts Have Been Leaked?
Breach trackers and threat intelligence firms count the accounts and passwords found in leaked or stolen data.
21. 17.8 billion breached account records are indexed in Have I Been Pwned as of October 2026 (Have I Been Pwned, homepage). They come from 1,045 breached websites.
Source: Have I Been Pwned, homepage. Breached account records indexed as of October 2026.
22. 1.3 billion unique passwords were in one credential-stuffing list added to Have I Been Pwned in November 2025 (Troy Hunt, Have I Been Pwned). The same list held 1,957,476,021 unique email addresses. Of the passwords, 625 million were new to the service.
In SpyCloud’s report, a “credential pair” is a stolen username or email address plus its password (SpyCloud, 2026 Identity Exposure Report press release).
23. SpyCloud recaptured 5.3 billion credential pairs from criminal sources in 2025 (SpyCloud, 2026 Identity Exposure Report summary). That was up 65% year over year.
In KELA’s report, “compromised credentials” means login data such as usernames, passwords, session tokens and cookies taken from malware, breaches or marketplaces (KELA, The State of Cybercrime 2026).
24. KELA tracked 2.86 billion compromised email credentials in 2025 (KELA, The State of Cybercrime 2026). KELA says the credentials were exposed, but some may not work for logging in.
In Troy Hunt’s description for Have I Been Pwned, “stealer log” data comes from malware running on infected machines (Troy Hunt, Have I Been Pwned).
25. Malware infections stole 642.4 million credentials in SpyCloud’s 2025 data (SpyCloud, 2026 Identity Exposure Report). SpyCloud recaptured 13.2 million infostealer logs from 2025 infections. That was down from 18 million the year before, after law enforcement action.
26. 347.5 million credentials came from about 3.9 million infostealer-infected machines KELA observed in 2025 (KELA, The State of Cybercrime 2026). In 2024, KELA recorded 4.2 million infected machines and 331.4 million credentials.
27. SpyCloud recaptured 1.1 million password manager master passwords from criminal sources in 2025 (SpyCloud, 2026 Identity Exposure Report).
What Are the Most Common Passwords?
Studies of leaked passwords show which ones people pick most often. Surveys add what people put into their own passwords.
28. “123456” topped NordPass’ 2025 list of the world’s most common passwords (NordPass, Top 200 Most Common Passwords). It was the sixth time in seven years. The list covers breach and dark web data from 44 countries, September 2024 to September 2025.
29. “123456” was the most common of the 6 billion stolen passwords Specops analyzed for 2025 (Specops, 2026 Breached Password Report). The next four were “123456789”, “12345678”, “admin” and “password”. The data came from infostealer malware logs, credential aggregation sources and underground marketplaces.
30. Over 727 million leaked passwords contained “1234” in Cybernews’ 2024–2025 dataset (Cybernews, password leak study). That is almost 4% of all passwords. Of those, 338 million contained “123456”.
31. 1.08 billion stolen passwords in Specops’ 2025 data were exactly eight characters long (Specops, 2026 Breached Password Report). That was the most common length.
32. 19% of leaked passwords mixed lowercase, uppercase, numbers and symbols in 2024–2025 (Cybernews, password leak study). That was up from 1% in 2022.
33. 16% of Americans in 10 large metro areas use a significant date as a password (2025) (Yubico, survey of 5,000 Americans). In the same survey, 13% use a pet’s name and 9% use the word “password” itself.
34. 36% of people surveyed in six countries use personal information in their passwords (2024) (Bitwarden, World Password Day 2024). The survey covered 2,400 people in the US, UK, Australia, France, Germany and Japan.
Password Habit Statistics
Consumer Reports asked US adults what they do about passwords and logins. The chart below shows their answers.
| Practice | 2026 |
|---|---|
| Use multifactor authentication without an app, such as through a text | 44 |
| Use strong passwords—that is, at least 16 characters long and difficult to guess | 44 |
| Use a multifactor authentication app | 37 |
| Use a password manager to store passwords | 36 |
| Use different passwords for every account | 35 |
| Use a passkey–that is, a digital credential tied to a user account | 30 |
| Write down passwords on paper or in a digital file, such as a Word document | 30 |
| Change passwords regularly, such as every six months or more frequently | 24 |
| Use a password manager to generate passwords | 21 |
| None of these | 7 |
| Use a physical security key, such as a YubiKey | 3 |
How Many Passwords Do People Keep?
NordPass researches how many passwords its own users keep.
35. NordPass users have about 120 personal passwords on average (2026) (NordPass, How many passwords does the average person have). They also have about 67 work-related passwords on average. NordPass surveyed 1,509 of its users.
How Common Is Password Reuse?
Most figures below come from surveys in different countries. The last two come from leaked data, and the last one counts passwords, not people.
36. 62% of Americans say they “often” or “always” reuse a password (2025) (NordPass, password reuse survey). The US sample was 619 adults, out of 1,727 surveyed in the US, UK and Germany.
37. 35% of US adults say they use a different password for every account (2026) (Consumer Reports, 2026 Consumer Cyber Readiness Report).
38. 26% of UK online adults say they re-use passwords across different accounts (2025) (Ofcom, Adults’ Media Use and Attitudes 2026). That rises to 34% among those aged 16–24.
39. 72% of Gen Z employed adults in six countries reuse passwords (2025) (Bitwarden, World Password Day 2025 Survey). That compares with 42% of Boomers. The survey covered over 2,300 employed adults in the US, Australia, the UK, Germany, France and Japan.
40. 62% of adults in seven countries say they use a unique password for important accounts all or most of the time (2025) (CybSafe and National Cybersecurity Alliance, Oh Behave! 2025–2026). That was 3% lower than in 2024. The survey covered 7,000 adults.
41. 7 in 10 consumers in SpyCloud’s 2025 exposure data had reused an exposed password (SpyCloud, 2026 Identity Exposure Report). For corporate users, it was 4 in 10.
42. 94% of 19 billion passwords in leaks Cybernews analyzed were reused or duplicated (12 months from April 2024) (Cybernews, password leak study). Cybernews says duplicate entries in some leaked sources explain this only partly.
How Many People Use Strong Passwords?
These figures show how many people say they use long or complex passwords.
43. 44% of US adults say they use strong passwords of at least 16 characters (2026) (Consumer Reports, 2026 Consumer Cyber Readiness Report). Consumer Reports defined strong as at least 16 characters long and difficult to guess.
44. 72.5% of internet users aged 16+ in England and Wales say they use complex passwords (year to March 2025) (ONS, Crime Survey for England and Wales). The survey asked only a quarter of its sample. Within that group, it asked only those who had used the internet in the last year.
45. 58.1% of internet users aged 16+ in England and Wales use different, strong passwords for important accounts (year to March 2025) (ONS, Crime Survey for England and Wales).
46. Only 25% of adults in seven countries create passwords of 12 or more characters (2025) (CybSafe and National Cybersecurity Alliance, Oh Behave! 2025–2026). The most common length was 9 to 11 characters, chosen by 40%.
How Do People Store Their Passwords?
These surveys ask how people keep track of their passwords.
47. 51% of US adults say they memorize their passwords (2024) (Security.org, Password Manager Industry Report). That was up from 41% in both 2022 and 2023. Memorizing was more common among those under 30 (64%) than those over 60 (35%).
| Method | 2022 | 2023 | 2024 |
|---|---|---|---|
| I have my passwords memorized | 41 | 41 | 51 |
| I use a password manager | 21 | 34 | 36 |
| I save my passwords in my browser | 25 | 27 | 34 |
| I save them in a note on my computer or mobile device | 25 | 25 | 26 |
| I write them down on paper | 32 | 30 | 25 |
| I use the same few passwords on all my accounts | 22 | 21 | 18 |
| I use a security passkey or other physical password device | 10 | 10 |
48. 34% of US adults save their passwords in a web browser (2024) (Security.org, Password Manager Industry Report). That was up from 25% in 2022 and 27% in 2023. Of those, only 24% are fully aware of the security differences from dedicated password managers.
49. 45% of Americans keep passwords in an unencrypted digital note or on paper (2024) (Security.org, Password Manager Industry Report). In the same poll, 25% said they write passwords on paper. That was down from 32% in 2022 and 30% in 2023.
50. 30% of US adults say they write down passwords on paper or in a digital file (2026) (Consumer Reports, 2026 Consumer Cyber Readiness Report).
51. 31% of adults with more than one online account prefer writing passwords in a notebook, across seven countries (2025) (CybSafe and National Cybersecurity Alliance, Oh Behave! 2025–2026). Another 21% said they remember their passwords without storing them anywhere.
52. 45.9% of internet users aged 16+ in England and Wales save passwords in a browser or password manager (year to March 2025) (ONS, Crime Survey for England and Wales). The survey treats browser and password manager as one answer option.
How Often Do People Change Their Passwords?
These figures show how often people update their passwords.
53. 24% of US adults say they change passwords regularly, such as every six months (2026) (Consumer Reports, 2026 Consumer Cyber Readiness Report).
54. 35% of Gen Z employed adults in six countries rarely or never update passwords after a breach at a company where they have an account (2025) (Bitwarden, World Password Day 2025 Survey).
How Often Do People Forget Their Passwords?
These surveys ask how often people forget passwords and what they do next.
55. One in five UK online adults say they frequently forget their passwords (2025) (Ofcom, Adults’ Media Use and Attitudes 2026).
56. 55% of employed adults in six countries have abandoned an account or created a new one to avoid a password reset (2025) (Bitwarden, World Password Day 2025 Survey). Among Gen Z, 30% often or always forget passwords to important accounts.
How Many People Share Their Passwords?
These figures show how often people share passwords with others, and how they do it.
57. 5.6% of online Australians aged 18+ shared an account password or code in the past 12 months (2025) (Australian Institute of Criminology, Cybercrime in Australia 2025). They shared it with someone they knew, or thought they knew, for an account they own.
58. 25% of Gen Z employed adults in six countries share passwords by text message (2025) (Bitwarden, World Password Day 2025 Survey). And 19% share them as screenshots.
Workplace Password Statistics
How Secure Are Passwords at Work?
These figures come from surveys of staff at large organizations and from government surveys of businesses.
59. 43% of technology and security professionals log in to work accounts with a username and password (2026) (Yubico and Okta, 2026 Global State of Authentication). The survey covered 1,890 professionals at organizations with 500+ employees in nine markets.
60. 23% of technology and security professionals say their organization does not require multifactor authentication (MFA) on all enterprise apps and services (2026) (Yubico and Okta, 2026 Global State of Authentication). In the same survey, 45% said usernames and passwords are the primary credential across their organization’s systems.
61. 74% of UK businesses have a password policy that ensures users set strong passwords (2026) (DSIT, Cyber Security Breaches Survey 2025/2026). Among large businesses with 250+ employees, the figure is 96%.
62. 83.7% of EU enterprises with 10+ people employed used strong password authentication in 2024 (Eurostat, ICT security in enterprises). Among large firms with 250+ people employed, the share was 96.8%. The figures exclude finance, agriculture and mining.
63. 57% of organizations with 500+ employees in 10 countries say staff mainly sign in with a method attackers can phish (2026) (FIDO Alliance, State of Passkeys 2026). That includes 11% who said password only. Another 30% said a passkey-based method was primary.
Password Manager Statistics
How Many People Use a Password Manager?
These figures show who uses a password manager, which one, and how they secure it.
64. Four in 10 Americans use password managers in some fashion (2026) (Consumer Reports, 2026 Consumer Cyber Readiness Report). In the same survey, 36% use one to store passwords and 21% use one to generate them.
Source: Consumer Reports, 2026 Consumer Cyber Readiness Report, p. 16. Share of US adults who use password managers in some fashion, March–April 2026.
65. 36% of US adults use a password manager, about 94 million people (2024) (Security.org, Password Manager Industry Report). The share was 21% in 2022 and 34% in 2023.
66. 41% of adults in seven countries have never used a password manager (2025) (CybSafe and National Cybersecurity Alliance, Oh Behave! 2025–2026). The survey covered 7,000 adults in the US, UK, Germany, Australia, India, Brazil and Mexico.
67. 46% of Gen Z employed adults in six countries use a password manager (2025) (Bitwarden, World Password Day 2025 Survey). That compares with 39% of Millennials and 33% of Gen X.
68. 32% of US password manager users relied mainly on Google Password Manager (2024) (Security.org, Password Manager Industry Report). Another 23% used Apple’s, and 11% used LastPass.
69. 14% of US password manager users reuse an existing password as their master password (2024) (Security.org, Password Manager Industry Report). That share was 28% a year earlier.
Multi-Factor Authentication Statistics
Multifactor authentication (MFA) adds a second step to logging in, such as a code sent by text.
How Many People Use Multi-Factor Authentication?
These figures come from surveys of adults and from Okta’s sign-in data for workers.
70. 60% of US adults say they use some type of multifactor authentication on their online accounts (2026) (Consumer Reports, 2026 Consumer Cyber Readiness Report). Respondents could pick more than one method. Of all adults, 44% use MFA without an app, such as by text, and 37% use an authenticator app.
71. Only 41% of adults in seven countries said they use MFA regularly (2025) (CybSafe and National Cybersecurity Alliance, Oh Behave! 2025–2026). Another 23% had never heard of it.
72. 56.2% of internet users aged 16+ in England and Wales use two-factor authentication wherever possible (year to March 2025) (ONS, Crime Survey for England and Wales). That was up from 50.7% a year earlier.
73. 58.7% of online Australians aged 18+ used multifactor or two-factor authentication for personal accounts in the past 12 months (2025) (Australian Institute of Criminology, Cybercrime in Australia 2025). In the same survey, 27.4% used a secure password manager.
In Okta’s report, “MFA adoption” means the share of users who signed in with MFA during a one-month period (Okta).
74. 70% of workforce users on Okta signed in with MFA as of January 2025 (Okta, Secure Sign-in Trends Report 2025). Nearly a third still lacked MFA.
75. 87% of tech-sector workforce users on Okta used MFA in January 2025 (Okta, Secure Sign-in Trends Report 2025). Transportation and warehousing (42%) and retail (52%) were at the low end.
In Okta’s report, “phishing-resistant authenticators” means Okta FastPass, WebAuthn and smart cards (Okta).
76. 14.0% of workforce users on Okta used phishing-resistant authenticators in January 2025 (Okta, Secure Sign-in Trends Report 2025). That was up from 8.6% a year earlier. Password use fell from 95.1% to 93.0% of users.
How Many Businesses Use Multi-Factor Authentication?
These figures come from government business surveys and a survey of IT and security leaders.
77. 47% of UK businesses require two-factor authentication for network or application access (2026) (DSIT, Cyber Security Breaches Survey 2025/2026). Among large businesses, 90% do.
78. 39.8% of EU enterprises with 10+ people employed used multi-factor authentication in 2024, up from 31.0% in 2022 (Eurostat, ICT security in enterprises). Eurostat counts any combination of at least two login methods, such as a password plus a one-time code. The figures exclude finance, agriculture and mining.
79. Only 19% of companies in North America and Europe had deployed FIDO2 security tokens (2025) (Cisco Duo, 2025 State of Identity Security). These tokens are a phishing-resistant type of MFA. The survey covered 650 IT and security leaders.
How Well Does Multi-Factor Authentication Work?
Microsoft reports how often MFA stops unauthorized access attempts.
80. MFA blocks over 99% of unauthorized access attempts, according to Microsoft (2025) (Microsoft, Digital Defense Report 2025).
Passkey Statistics
Passkeys let people sign in without typing a password.
How Widely Are Passkeys Used?
These figures come from surveys, a FIDO Alliance estimate and companies that offer passkeys.
In the FIDO Alliance’s definition, a “passkey” is a sign-in credential stored on a phone, computer or security key and unlocked like the device itself (FIDO Alliance).
81. An estimated 5 billion passkeys were in use worldwide as of May 2026 (FIDO Alliance, World Passkey Day 2026 release). The FIDO Alliance built the estimate from public data and its own deployment data.
Source: FIDO Alliance, World Passkey Day 2026 release. Estimated passkeys in use worldwide as of May 2026.
82. 30% of US adults say they use a passkey to log in to online accounts (2026) (Consumer Reports, 2026 Consumer Cyber Readiness Report). Just 3% say they use a physical security key, such as a YubiKey.
83. 75% of consumers in 10 countries had enabled passkeys on at least some accounts (2026) (FIDO Alliance, State of Passkeys 2026). That includes 40% who had enabled them on most of their apps and accounts. The FIDO survey covered 11,000 adults who regularly log in online.
84. 74% of US consumers had enabled passkeys on at least some accounts (2026) (FIDO Alliance, State of Passkeys 2026). The rate was 88% in both China and India.
85. Over 400 million Google Accounts had used passkeys as of May 2024 (Google, Passkeys, Cross-Account Protection and new ways we’re protecting your accounts). Those passkeys had been used to sign in more than 1 billion times.
86. 40% of Dashlane users stored at least one passkey in 2025, double the year before (Dashlane, Passkey Power 20). Passkey sign-ins through Dashlane more than doubled to 1.3 million a month.
How Many People Know About Passkeys?
These surveys ask whether people are familiar with passkeys.
87. 90% of consumers in 10 countries were aware of passkeys (2026) (FIDO Alliance, State of Passkeys 2026). Only 7% said they were not familiar with them at all.
88. 87% of technology and security professionals are familiar with passkeys (2026) (Yubico and Okta, 2026 Global State of Authentication). Only 3% have never used one. The survey covered 1,890 professionals in nine markets.
How Well Do Passkeys Work?
Microsoft compares sign-in success for passkeys and passwords.
89. Microsoft account users signing in with passkeys succeed about 98% of the time, versus 32% for password users (2025) (Microsoft Security Blog). Microsoft also says passkey sign-ins are eight times faster than a password plus multifactor authentication.
How Many Organizations Use Passkeys?
The FIDO Alliance asked larger organizations about passkeys for their staff.
90. 68% of organizations with 500+ employees in 10 countries were deploying, piloting or had deployed workforce passkeys (2026) (FIDO Alliance, State of Passkeys 2026). The survey covered 1,400 decision-makers.
Conclusion
Stolen and reused passwords show up in breach studies, attack data and leaked files. Passkeys and two-step logins are spreading, yet many people still reuse passwords or write them down. We’ll update this page as new data comes out.