This field-guide entry has not been reviewed in its new form yet. The studies are summarized as published; no review date is implied.
Key findings #
An estimated 43-51% of users reuse the same password across multiple sites.
With a user’s password from another site, a cross-site guessing algorithm guessed 30% of transformed passwords within 100 attempts, compared with 14% for a standard guessing algorithm.
When researchers observed 154 people’s real logins for an average of 147 days, about 60% of their unique passwords were exactly or partially reused.
People reuse each password on 1.7-3.4 websites, and they mostly reuse the complex passwords they have to enter frequently.
Fewer than a third of people shown a typical password-reuse notification said they intended to change any passwords.
Evidence #
| Study | Year | Sample | Method | Finding |
|---|---|---|---|---|
| Let's Go in for a Closer Look: Observing Passwords in Their Natural HabitatCarnegie Mellon University, ICSI, Google | 2017 | 154 participants, 147 days on average | In situ measurement on participants' computers | About 60% of unique passwords were exactly or partially reused. |
| The Tangled Web of Password ReuseUniversity of Illinois, Princeton, Indiana University | 2014 | Several hundred thousand leaked passwords from 11 sites; 224 survey responses | Leak analysis, survey, guessing experiment | Estimated 43-51% of users reuse the same password across sites. |
| Understanding Password Choices: How Frequently Entered Passwords are Re-used Across WebsitesMichigan State University, Macalester College | 2016 | 134 participants over 6 weeks | Survey combined with measured online behaviour | Each password is reused on 1.7-3.4 websites, mostly the frequently entered ones. |
| A Large-Scale Study of Web Password HabitsMicrosoft Research | 2007 | Over half a million users, 3 months | Client-side measurement | The average user had 6.5 passwords, each shared across 3.9 sites. |
| Designing Password-Reuse Notifications | 2018 | 180 and 588 respondents | 2 online user studies of notification designs | Fewer than a third of respondents in study 1 intended to change any password. |
What to do #
For engineers #
- Assume that some of your users’ passwords are already in another site’s breach. Check passwords against breach data at sign-up, password change and login. The compromised credentials entry covers protocols that do this without sending the password to a third party.
- Treat a correct password as one signal among several. Das et al. show that a leaked password from another site gives an online attacker a large head start, so rate limits alone aren’t enough. See reinforced authentication and step-up authentication.
- Make unique passwords cheap for users: allow paste, long passwords and autofill so a password manager works. I wrote about this in password-manager-friendly login forms and long password support.
- Where you can, offer a factor that can’t be reused at all, such as passkeys. See my critical notes on passkeys.
For product and UX #
- Composition rules can backfire. Wash et al. found that people memorize a strong password for a site they log into often and then reuse it elsewhere. Read password policy before adding another character-class rule.
- Don’t rely on a notification alone. Golla et al. conclude that “notifications alone appear insufficient in solving password reuse”. Pair the message with a forced reset and a clear next step, such as using a password manager.
The studies in detail #
Observing Passwords in Their Natural Habitat #
Researchers from Carnegie Mellon University, the International Computer Science Institute and Google instrumented the computers of 154 participants for an average of 147 days each. They wanted to analyze “password characteristics and behaviors across the full range of participants’ web-based accounts”.
Among other things, the data showed “that the use of symbols and digits in passwords predicts increased likelihood of reuse, while increased password strength predicts decreased likelihood of reuse; that password reuse is more prevalent than previously believed, especially when partial reuse is taken into account”. Of 1,578 unique passwords, 32% were exactly reused and about 60% showed some form of reuse.
The Tangled Web of Password Reuse #
This 2014 study by researchers from the University of Illinois, Princeton and Indiana University used several hundred thousand leaked passwords from 11 websites and a user survey with 224 responses. The authors estimate that “43-51% of users reuse the same password across multiple sites”. They also identified “a few simple tricks users often employ to transform a basic password between sites” and built the first cross-site password-guessing algorithm.
That algorithm guessed 30% of transformed passwords within 100 attempts, compared with 14% without knowledge of the other site’s password. A leaked password helps the attacker even when the user changed it slightly for the next site.
Understanding Password Choices: How Frequently Entered Passwords are Re-used Across Websites #
Researchers from Michigan State University and Macalester College combined survey answers with the measured online behavior of 134 participants over 6 weeks. They found “that people do tend to re-use each password on 1.7–3.4 different websites” and that “they reuse passwords that are more complex, and mostly they tend to re-use passwords that they have to enter frequently”.
The most interesting observation is how accounts depend on each other, which shows the trouble with arbitrary password composition requirements:
“[…] if users must memorize a strong password on a website where they have to enter it frequently, they then re-use it elsewhere. This results in stronger passwords on more websites. This practice puts users at greater risk of cross-site password guessing attacks […]”
A Large-Scale Study of Web Password Habits #
Microsoft researchers measured the password use and reuse of over half a million users over 3 months in 2007, using a client component on users’ machines. It was the first large-scale study of its kind. The average user had 6.5 passwords, each shared across 3.9 different sites, and about 25 accounts that required a password. The authors write that the results “particularly confirm the conventional wisdom about the large number and poor quality of user passwords. In addition passwords are re-used and forgotten a great deal.”
Designing Password-Reuse Notifications #
When companies find stolen credentials and notice password reuse, they may require a password reset and notify affected users. Researchers from Germany and the USA ran 2 user studies in 2018 to learn how people react to such notifications. In the first, 180 respondents each saw 1 of 6 notifications that real companies had used, and fewer than a third reported an intention to change any passwords. In the second, 588 respondents saw 1 of 15 variations of a model notification. The authors discuss “best practices for password-reuse notifications and how notifications alone appear insufficient in solving password reuse”.