How SplashData knows about Worst Passwords used by users annually

Question

It is known that every reputable website stores their user passwords into their database after implementing some hashing algorithm on it, and even they don't know what the actual password of the user is; and when the user logs in to their website, a HASH is generated from user's input password and compared to the hash previously stored into the database.

If this is true, then how come websites like SplashData.com releases the list of weakest password annually.? How come do they get their hands-on the plain text of the user password if it was hashed?

Here are some of the links for convenience,

SplashData:

• "Password" unseated by "123456" on our annual "Worst Passwords" list
• Worst Passwords of 2012 — and How to Fix Them
• CNN talking about SplashData

'123456' tops list of worst passwords

• Symantec talking about SplashData

The Worst Passwords of 2013

Answer 1

Your first link says what the source is:

This list is from files containing stolen passwords posted online during the previous year.

In a perfect world this would not happen. Not only would everyone salt and hash their passwords with an expensive algorithm, security would also be good enough that password lists won't get stolen. Unfortunately the world we live in isn't perfect.

Leaks from large databases happen all the time.

There are still large services which store passwords in plaintext. Most at least hash their passwords, but then they either don't salt them, or salt them but then use an algorithm which is fast enough to make brute-forcing of weaker passwords feasible (like those from the SHA-family, for example).

Answer 2

While "reputable" websites may do this, there are just as many that do not securely store them and get compromised. Compromised password databases are available, and if you acquire them, you can construct such a list as the one that SplashData has constructed.

Answer 3

I can't comment yet, so I will post an answer.

I can think of two things that they could do:

1. Run a list of bad passwords through their hashes and see how many correspond to their database of password hashes, then count and rank them.

2. Reverse engineer a sample set of their password hashes(why devote too much time to this?) and aggregate data on the brute forcible passwords, then rank them.

I can't tell what their exact methods are, but it doesn't make sense that it would be something too resource or time intensive.