New research from Kaspersky has revealed that every year, hundreds of millions of real user passwords are leaked onto the dark web. The cybersecurity firm noted that passwords remain as weak as ever, while cracking them has become faster and easier each year.
Alarming Crack Times
Specifically, Kaspersky stated that today, 60 percent of passwords can be cracked in less than an hour, noting that two years ago, that figure was 59 percent. However, the most concerning finding is that nearly half of all passwords (48 percent) are cracked in less than a minute.
The firm highlighted persistent weaknesses and predictability in user password behavior, particularly as artificial intelligence is increasingly used by hackers to exploit predictable security habits.
Analysis of 231 Million Passwords
Kaspersky experts analyzed 231 million unique passwords from major password leaks between 2023 and 2026. The security firm revisited existing research conducted in 2024 to provide new statistics for World Password Day, observed on May 7, 2026. The 2024 database was expanded by an additional 38 million real passwords posted by attackers on dark web forums.
The company emphasized that to crack 60 percent of these passwords, a hacker needs only an hour and a few dollars. More than 50 percent of leaked passwords end with a number, and the "@" symbol appears in 10 percent of cases.
Growing Concerns
According to the latest data, the findings point to highly predictable structures, widespread reuse of common patterns, and growing concerns about how quickly modern passwords can be compromised. In 2024, 45 percent of passwords could be cracked in less than a minute, but in 2026, that figure climbed to 48 percent. Within an hour, 59 percent were crackable in 2024, currently 60 percent; within 24 hours, it was 67 percent in 2024, now rising to 68 percent of passwords.
