📰 Originally published on SecurityElites — the canonical, fully-updated version of this article.

The 2023 Home Security Heroes study ran PassGAN against a database of 15.6 million passwords. The results: 51% cracked in under a minute. 65% cracked in under an hour. 81% cracked within a month. PassGAN isn’t a traditional dictionary attack — it’s a generative adversarial network trained on real leaked passwords that generates novel guesses matching the statistical distribution of how humans actually choose passwords.

Those numbers don’t mean 81% of all passwords are crackable. They mean 81% of the passwords in that particular dataset — which represent how real users choose passwords — were crackable. The passwords that weren’t cracked were the randomly generated ones, the long ones, and the ones protected by slow hashing algorithms that limited the guess rate.…