Eye-Opening Study Finds That Only 6% of 19 Billion Leaked Passwords Were Unique

A recent cybernews study, analyzed a large dataset of 19 billion leaked passwords from cybersecurity incidents in 2024 and 2025, uncovering concerning data.

One of the most alarming discoveries was that 94% of the leaked passwords consisted of duplicated and reused credentials. This means that only 6% of the 19 billion passwords were unique and considered secure.

This study confirms how poorly managed passwords are, indicating a high rate of simple keyboard patterns like “123456” and short credentials with less than 10 characters without symbols or uppercase letters. Additionally, there’s still a wide use of words like “password” and “admin”, making this lack of password hygiene a treat for cybercriminals, especially for experts in credential stuffing cyberattacks.

What the study found:

• High rate of password reuse: 94% of passwords are reused or duplicated.
• High rate of common password patterns and popular names: The majority of passwords included personal names, popculture terms, and lazy keyboard patterns.
• Low rate of unique passwords: Only 6% of the analyzed passwords were unique.
• Dangerous password length and composition: Many credentials comprised 8 to 10-character passwords.
• High risk of cyberattack: Weak passwords are an easy target for cybercriminals, and reused credentials allow them to compromise other accounts, which can trigger a devastating chain reaction.

There’s no reason to use easy-to-decipher passwords still, and we’re past saving them in notepads or Excel sheets. There’s an abundance of password management solutions that allow you to save time and brain memory. In fact, even during a breach, they can still be lifesavers.

Password managers offer features such as complex password generators, encrypted storage, autofill, form filling, browser extensions, offline access, and mobile apps for on-the-go access. However, some options go beyond securely storing passwords, offering additional online security services like VPNs, dark web monitoring, and identity theft protection.