# What is probability of a user picking a published password?

Say I have a large list (10 million) of published accounts and associated passwords.

Assume this is a representative sample of population of account passwords.

From this sample I can generate a distribution of passwords ordered from most used to least.

There will likely be a password that is used more than any other and there will also be a large number of passwords used once (unique passwords).

Say number of unique passwords is 50%.

Can I therefore conclude that when a user invents a password that there is a 50% probability that they will pick a universally unique password?

If not, what can I conclude?

• Depends on what you mean by "unique". Unique among the 10 million passwords on the list? Unique among all leaked passwords? Unique amon all passwords ever used by anyone anywhere? Sep 18 '18 at 11:10
• `Can I therefore conclude that when a user invents a password that there is a 50% probability that they will pick a unique password?` I think this strongly depends on the security awareness of your users. Security.stackexchange.com will have less reused passwords than cooking.stackexchange.com imho. I don't think there is a direct decisive relation between the number of users and the number of reused passwords. Sep 18 '18 at 11:12
• @Anders. I see what you are getting at... I'd like some statement about universal uniqueness. Sep 18 '18 at 11:24
• This sounds more like a question about statistics, that it is a question about security. If you want a statement about unique passwords, you should amend your question that way. Sep 18 '18 at 11:51
• @philcolbourn the word you are looking for is not "uniqueness". The word you are looking for is "random". A long random password will most likely be unique in a list of 10 million passwords. However, the user didn't "pick" a unique password (such a concept is effectively meaningless anyway) - they just selected a random password, which happens to have a a high chance of being unique in a list of 10 million passwords. Sep 18 '18 at 13:28

The answer will vary wildly depending upon the habits and security-awareness of the person in question. However, we can come to some conclusions depending on the "type" of person. At least, we can if we simplify people into one of two categories:

People who use computers to generate truly random passwords

People who pick their own easy-to-remember passwords

As is generally well known, people tend to reuse a lot of passwords, and a lot of common passwords are used by many people. However, it can be very difficult to actually calculate the frequency with which particular passwords are used. For instance, most studies of password dumps find that `123456` is the most common password. This article pegs the frequency of that password at 0.6%, but as discussed in that article there are many caveats. My own cursory reading of this plot suggests that the top 25 most common passwords might account for something like 10% of all passwords. It's hard to extrapolate that to the top 10 million passwords though.

As my first link suggests though, there are likely many caveats. For instance, if you ask someone to pick a password for their bank account they may try harder than `123456`. Indeed, there is some evidence that people are getting better at passwords in recent times, and many of these data sets are based off of leaks that are a few years old. Those are just two of many potential gotchas that make it hard to estimate for sure what the odds are that some random user's password might be in your list.

Again though, it very much depends on the person. If you are talking about the kind of person who picks `123456` for their password, then there is a 100% chance that their password will be in your list of 10 million passwords. If you are talking about someone who generates long random passwords, then there is probably a 0% chance that their password is in your list. If you're talking about someone in the middle, then who knows.

• Note that Keeper analysis of 10M passwords only considered passwords that appeared in 2 or more password database made public in 2016: "Outliers (passwords that only appeared in 1 breach) were not considered for this study" Sep 20 '18 at 1:54
• I'm skepical that 17% of users use 123456. My 10M list has this password (also most popular) at 0.56% - could it be that these breached accounts are considered burner accounts or unimportant? Given that site allows 6 character passwords, they don't seem to be worried about password strength. Sep 20 '18 at 1:57
• Keeper report states that top 25 passwords account for 50% of passwords - again, my data shows that top 25 account for about 2% of all passwords. Worth noting that half of Keeper top 12 are also in my top 25. Sep 20 '18 at 2:12
• Keeper eliminated unique passwords from their study. If, as with data I'm using, 50% are unique, then this doubles their percentages. Sep 20 '18 at 2:17
• BTW, I found this different analysis of 10 million passwords: wpengine.com/unmasked Sep 20 '18 at 2:38

10 million is a pretty big sample, so if your source for that sample is realiable (i.e. the number of fake, duplicate or robot-accounts, etc is low), then you should be able to draw some kind of conclusion from it. Keep context in mind though: Are these security.stackexchange users, or facebook users?

Your conclusion sounds kind of plausible, except for one thing: Passwords may not be "unique" as in "used only by one single person globally", even if they are unique within your sample. Again, you'll need some context.

If you change your postulate from:

"There is a 50% probability that someone will pick a unique password"

To something like:

"There is a 50% probability that someone will pick a password used less frequently than (frequency / number of users)"

...then I would think you could draw some useful conclusion from it.

Perhaps someone with greater insight into statistics can complement (or contradict) this? It's an interesting question.

Assuming you have a random sample of all passwords (you don't, but it might be a good enough approximation), you can conclude that there is a 50% probability that a user picks a password used less often than one in ten million.

You can not conclude that there is a 50% probability that a user picks a globally unique password. That probability is much, much lower. After all, plenty of those five million users with unique passwords in your set might have duplicates among the billions of passwords used around the world.

Think about it like this: If you have a set of ten passwords, all different, could you conclude that all users pick globally unique passwords?

• nice. I can conclude 50% prob. that a user picks a unique password less often than 1 in 10M - actually, I think you mean more often than 1 in 10M? Sep 20 '18 at 2:19
• @philcolbourn Statement is true both ways. But it's not about "unique" passwords, it's about passwords used at specific frequencies. Sep 20 '18 at 6:32