🔒 Password Security, Entropy & Credential Breaches

The Scale of the Password Problem

Password breaches continue to dwarf all other attack vectors. In 2025, a single mega-leak exposed approximately 16 billion credentials from major platforms, compiled from 30 recent data breaches (Heimdal Security — Password Breach Statistics (2025)). Verizon’s 2025 Data Breach Investigations Report found that 2.8 billion passwords were put up for sale on criminal forums in 2024 alone, with stolen credentials averaging just $10 on underground markets. The 2026 DBIR (published 20 May 2026) adds a notable shift: vulnerability exploitation overtook stolen credentials as the top initial-access vector for the first time. Some criminal groups now sell subscription packages: a reliable stream of stolen passwords for $81 per week.

The human factor remains the weakest link. An estimated 94% of passwords are reused across two or more accounts, and only 3% of passwords meet NIST complexity requirements (DeepStrike — 70+ Password Statistics (2025)). The top 10 most common passwords — led by 123456, password, and admin — can all be cracked in under one second. Approximately 88% of passwords used in successful attacks were 12 characters or fewer (Spacelift — 70+ Password Statistics (2026)).

What Is Password Entropy?

Entropy measures password unpredictability in bits. The formula is E = log₂(CL) where C is the character set size and L is the password length. Length carries maximum mathematical weight: a 16-character numeric password provides the same entropy as an 8-character password using all 94 printable ASCII characters (Astra — 30+ Password Statistics (2026)).

Practical entropy thresholds: 30–40 bits is crackable in minutes to hours; 50–60 bits in days to years; 70–80+ bits effectively requires millennia. The famous XKCD “correct horse battery staple” passphrase achieves approximately 97 bits of entropy while remaining memorable, because length and word-combination randomness compound exponentially (SafePasswordGenerator — Password Entropy Explained (2026)).

The critical insight is that complexity theater fails: P@ssw0rd123! has only ~34 bits of entropy despite being 12 characters with mixed types, because it follows predictable substitution patterns. Research shows 60% of users capitalize the first letter and append a number or symbol at the end. Attackers know this and build targeted dictionaries accordingly.

How Are Passwords Actually Cracked?

Brute Force

Systematically testing every possible combination. Modern GPUs can attempt approximately 100 billion guesses per second against unsalted hashes. An 8-character password with full ASCII falls in hours; 16 characters takes centuries.

Dictionary Attacks

Testing common words, phrases, and known leaked passwords. The RockYou dataset (32 million passwords from a 2009 breach) remains a standard starting point. Modern dictionaries incorporate breach data from billions of exposed credentials.

Credential Stuffing

Replaying username/password pairs from one breach against other services. Since 94% of passwords are reused, a single breach becomes a skeleton key. Verizon reported 37% of successful web application attacks used brute force or credential stuffing in 2025, up from 21% the previous year.

AI-Augmented Guessing

Large language models and neural networks now generate password candidates based on patterns learned from billions of leaked credentials. These tools go beyond traditional rule-based mangling to predict passwords that humans actually create, incorporating cultural references, seasonal patterns, and organizational naming conventions.

What Do the 2025 NIST Password Guidelines Say?

NIST Special Publication 800-63 (Digital Identity Guidelines) underwent a major update in 2025 that explicitly drops old complexity requirements and periodic change mandates. The new guidelines — Revision 4, finalized July 31, 2025 — emphasize an 8-character hard minimum with a recommended 15-character minimum where a password is the only authenticator, allowing passphrases up to 64 characters, and critically — checking new passwords against breach databases. If a user tries to set Summer2023! and it appears in the Have I Been Pwned database of 1 billion+ leaked passwords, the system should reject it (DeepStrike).

Has Your Password Been in a Data Breach?

Have I Been Pwned (HIBP), created by Troy Hunt, maintains a database of 850 million+ breached passwords. Its Pwned Passwords API uses a k-anonymity model: the client sends only the first 5 characters of the SHA-1 hash, and the API returns all matching hash suffixes. The client checks locally whether its full hash appears in the results. This means the actual password never leaves the user’s device — even the API operator cannot determine what password was checked.

Organizations can integrate HIBP’s API directly into authentication flows to reject compromised passwords at the point of creation. The Specops 2026 Breached Password Report analyzed over 6 billion stolen passwords captured during 2025, derived from infostealer malware logs, credential aggregation sources, and underground marketplaces (Specops — 2026 Breached Password Report).

That infostealer share carries an uncomfortable implication: password strength is irrelevant against malware that reads the credential after you type it. A 20-character passphrase and 123456 are equally exposed to a stealer running on the endpoint — entropy defends against guessing, not against theft at the keyboard. Device integrity is therefore part of password security rather than a separate concern: an endpoint suite such as Bitdefender affiliate, or the built-in Microsoft Defender that we earn nothing from, protects the machine that holds the vault.

Entropy by Character Set

Should You Use a Password Manager or Passkeys?

The password management market is projected to grow from $2.35 billion (2023) to $7.13 billion by 2030. Despite this, 38% of IT organizations still do not use password managers. The passkey standard (FIDO2/WebAuthn) offers a passwordless future using public-key cryptography, but adoption remains gradual. Until universal passkey support arrives, the recommended defense stack is: unique high-entropy passwords per account, generated and stored by a password manager, protected by a strong master passphrase, with multi-factor authentication enabled everywhere possible.

When isn’t two-factor authentication enough?

One-time codes are a big step up from a password alone (our assessment), but two attacks reported in autumn 2026 get past them. Neither needs your password to be weak.

Real-time relay: the fake “Meta Careers” booking page

Malwarebytes found fake Calendly booking pages for Meta job interviews. After you pick a time, the page shows a copy of the Facebook login, then asks for your two-factor code and a Google sign-in “for security” Malwarebytes (14 Oct 2026). The attackers try your password on the real site straight away and use your code before it expires. The Google step can ask you to approve a phone prompt, which may approve their login Malwarebytes (14 Oct 2026). The 11 domains it found used names like joinhire, joinquest and jointheteam on .cfd, .info and .works Malwarebytes (14 Oct 2026).

Why passkeys stop it: passkeys and hardware security keys “are tied to the genuine website”, so a look-alike page cannot use them Malwarebytes (14 Oct 2026). Malwarebytes’ advice: “Use passkeys or a security key where you can”. Only enter a code for a login you started yourself, never approve a prompt because a recruiter or booking page told you to, and check the real address bar Malwarebytes (14 Oct 2026).

Consent phishing: a malicious app instead of a stolen password

The FBI warned on 1 September 2026 about OAuth consent phishing (tricking you into granting an app access to your account). The targets are mainly prominent people, such as officials and media figures, and their families and contacts. A message, sometimes from someone posing as an event organiser, links to a real sign-in page of a legitimate provider. You then approve a permission request for the attacker’s app, which can read and send your email and open your files FBI IC3 (1 Sep 2026). The access lasts until you revoke it, and the FBI says it is revoked by “invalidating the token in their application security settings”, “not by changing the password” FBI IC3 (1 Sep 2026).

• Google account: open myaccount.google.com/linkedapps, choose “Access to your Google Account”, select the app, then See details > Remove access Google Account Help: linked apps (checked 16 Oct 2026).
• Microsoft work or school account: go to myapplications.microsoft.com, select the app’s menu (…) > Manage your application > Revoke Permissions. You can’t revoke permissions your administrator granted, so tell your IT team Microsoft Support: My Apps permissions (checked 16 Oct 2026).
• Report it: the FBI asks victims to keep screenshots and report to IC3 or their local FBI field office FBI IC3 (1 Sep 2026).

Key Definitions

Password Entropy

A measure of password unpredictability in bits. Higher entropy means more resistance to brute-force attacks. Calculated as log₂(possible_combinations), determined by character set size and length.

Credential Stuffing

Automated attack that tests stolen username/password pairs from one breach against other services, exploiting password reuse. Effective because approximately 94% of passwords are reused across multiple accounts.

k-Anonymity (HIBP)

Privacy-preserving technique where only the first 5 characters of a password hash are sent to the breach database API. The full hash is checked locally against returned results, so the actual password never leaves the client.

Password Spraying

Attack that tests a small set of extremely common passwords (like seasonal phrases with a year) against many accounts simultaneously, avoiding lockout thresholds.

NIST SP 800-63

NIST’s Digital Identity Guidelines, updated in 2025. Drops complexity mandates and periodic change requirements. Emphasizes length, breach database checking, and passphrases up to 64 characters.

Passkeys (FIDO2/WebAuthn)

Passwordless authentication using public-key cryptography. A unique key pair is generated per site, with the private key stored on the user’s device and protected by biometrics or a PIN. Eliminates phishing and credential stuffing risks.

Sources

Heimdal Security — Password Breach Statistics (2025) (16B credential leak, $10 average price). DeepStrike — 70+ Password Statistics (2025) (94% reuse, NIST 2025 update). Spacelift — 70+ Password Statistics (2026) (88% under 12 chars, 49% breaches involve passwords). Astra — 30+ Password Statistics (2026) (entropy formula, manager market). SafePasswordGenerator — Password Entropy (2026) (entropy thresholds, XKCD method). Specops — 2026 Breached Password Report (6B stolen passwords analyzed). Nucamp — Password Attacks in 2026 (AI guessing, GPU speeds). Malwarebytes — Fake Calendly “Meta Careers” pages steal Facebook and Google logins (14 Oct 2026) (relay phishing, passkeys). FBI IC3 — Malicious Cyber Actors Gain Access to Victim Accounts Through Consent Phishing (1 Sep 2026) (consent phishing). Google Account Help — Manage links between your Google Account and apps and Microsoft Support — Edit or revoke application permissions (removing app access).