I recently did an analysis of my password list to see which letters users most commonly used as the first password character. To put it into perspective, I also ran the same statistics on a wordlist of 250,000 English words. The results were not quite as I expected (click for a larger graph):

It is interesting that while some first characters go right along with general English word usage, there are some significant differences in the graphs. The first thing I noticed that there are quite a few passwords that start with J (6%), but only 1% of the English words I analyzed start with the letter J. The letters K and L also show a similar difference. To understand this, I decided to open up my password list (currently over 3.5 million passwords) and browse through the passwords that start with J to see exactly what was there.
What immediately caught my attention was that there are a lot of names in there–James, Jack, Jennifer, Jay, Janet, Jim, John. So I thought it would be interesting to take a list of common English names and overlay those same statistics. This is what I came up with:

The interesting thing here is that the password line (blue, diamond) more closely matches the English names line (green, triangle) than it does the general English words.

There are a few inconsistencies I haven’t researched in great detail yet, but for the most part, it appears that a password is more likely a name than it a general word.

As for the inconsistencies, here are some of interest:

• Most passwords start with the letter B, although that letter is not that common with English words or common names. This could be due to the fact that some of the most common passwords start with the letter B, such as batman, beer, baseball, basketball, etc. There are also several colors that start with B: black, blue, brown. There are many common prefixes and compound words that start with B that people tend to use in passwords, such as bull-, bad-, big-, and bud-. And finally, there are many sexually-oriented words that start with the letter B such as bang, boob, butt, bitch, blow, boner, balls, and of course, bigdick.
• There seems to be no correlation between passwords that start with L and either of the two other wordlists.
• The biggest disparity between passwords and names is the letter M, although English words seem to come into alignment there. This could be due to the fact that four top-twenty passwords start with M: master, monkey, mustang and mother

So what do we learn from this? Most passwords are probably either names, on the top 100 list of passwords, or some other variant of these.

Related posts

• No related posts.