It is known that every reputable website stores their user passwords into their database after implementing some hashing algorithm on it, and even they don't know what the actual password of the user is; and when the user logs in to their website, a HASH is generated from user's input password and compared to the hash previously stored into the database.
If this is true, then how come websites like SplashData.com releases the list of weakest password annually.? How come do they get their hands-on the plain text of the user password if it was hashed?
Here are some of the links for convenience,
- "Password" unseated by "123456" on our annual "Worst Passwords" list
- Worst Passwords of 2012 — and How to Fix Them
- CNN talking about SplashData
- Symantec talking about SplashData