How Strong Is Your Password, Really? I Tested 9 Passwords Against 1B+ Breached Records

On October 18, 2026, I took 5 passwords people actually use and checked each one against the HaveIBeenPwned database of over a billion breached passwords. The worst — qwerty123 — has appeared in 13,871,714 breaches. Then I generated 4 passwords with a proper random generator and measured exactly how long each would survive an attack. The gap between "looks strong" and "is strong" is enormous, and it's all measurable. Here are the real numbers.

How I tested this

Everything below ran on my own machine (Ubuntu 24.04, Python 3.12) on 2026-10-18:

• Breach checks: I used HaveIBeenPwned's k-anonymity API. Only the first 5 characters of each password's SHA-1 hash leave my machine, so the full password is never transmitted — this is the API's documented privacy design, and it's the same method their own site uses. The Pwned Passwords corpus holds well over a billion unique passwords: HIBP doesn't publish a live total, but founder Troy Hunt's public updates document billion-scale growth, including 1.3 billion unique passwords added in November 2025 (TechFinitive).
• Password generation: Python's secrets module (cryptographically secure randomness, the same module security tools use).
• Strength math: entropy in bits = length × log₂(charset size). Crack time in seconds = 2^entropy_bits ÷ 10^10, where 10^10 (10 billion) guesses/second is a worst-case attack speed for fast hashes like MD5/SHA-1.
• Reality check on that assumption: real websites should use slow hashes. Hive Systems' 2026 Password Table measured an 8-character lowercase password falling in ~2 weeks of wall-clock time against bcrypt (work factor 10), not seconds. So treat my crack times as the pessimistic (fast-hash) scenario and Hive's as the realistic-website scenario. Both point the same way: short passwords lose.

Test 1: Common passwords vs. the breach database

In plain English: every one of these human-pattern passwords has already leaked — the worst over 13 million times.

Two things stand out. First, adding 123 and ! to a dictionary word fools nobody — Password123! is in nearly 300,000 breaches. Attackers don't guess randomly; they run through exactly these patterns first. Second, even letmein2024, which feels obscure, is already burned. If a password follows a human pattern, assume it's in the database.

Test 2: Generated passwords — measured strength

In plain English: length beats cleverness — 12 random characters already buys you thousands of years, while 8 characters falls in seconds.

I generated one password per policy with secrets and computed the entropy. The symbol set for the 16-char policy is the 70 characters a-zA-Z0-9!@#$%^&* — 52 letters, 10 digits, and the 8 symbols !@#$%^&* (the common "safe symbol" subset most password generators default to):

The 8-character result is the important one: 37.6 bits of entropy sounds technical, but it means about 21 seconds against a fast hash — and Hive Systems measured 2 weeks against bcrypt in 2026, down from 3 weeks in 2025. Either way, 8 characters is not enough anymore.

The 12-character mixed password at 71.45 bits is the sweet spot: ~10,200 years even under my pessimistic assumption. You don't need 16 characters of symbol soup — 12 random mixed characters is already overkill for any realistic attacker.

The passphrase surprise (an honest limitation)

My 4-word passphrase scored a miserable 17.3 bits — crackable instantly. Why? Because I generated it from a tiny 20-word demo list, and entropy depends on the size of the word list, not just the word count. This is a real finding, not a flaw in passphrases: with a proper Diceware list of 7,776 words, 4 words give 4 × log₂(7776) ≈ 51.70 bits — about 4.2 days at my pessimistic speed, or centuries against bcrypt. The lesson: a passphrase is only as strong as its word list. Use a real generator (your password manager has one), not words you pick yourself.

What this actually means for you

1. Length beats complexity. A 12-character random password outperforms any "clever" 8-character one. This held true in my measurements and in Hive Systems' independent 2026 testing.
2. Check your own passwords at haveibeenpwned.com/Passwords — it uses the same safe k-anonymity method I used here.
3. Use a password manager's generator. Remembering 12+ random characters per site is impossible for humans; that's literally what password managers are for.
4. Turn on 2FA everywhere it matters. Even a great password can leak; a second factor (authenticator app or hardware key) stops most account takeovers cold, according to Bitwarden's own security documentation on two-step login.

FAQ

Is "Password123!" safe if I only use it on one unimportant site? No. My test found it in 295,389 breaches. Attackers try leaked passwords on every major site automatically (credential stuffing). There are no unimportant passwords.

Are password managers themselves safe? The reputable ones (Bitwarden, Proton Pass, KeePassXC) use zero-knowledge encryption — the company can't read your vault even if it wanted to. That's a fundamentally different risk profile than reusing one password everywhere.

How often should I change passwords? Only when there's a reason: a breach notification, or you learn a service stored passwords insecurely. Scheduled rotation of strong, unique passwords adds little — NIST's current guidance agrees.

What about passkeys? Passkeys are the strongest option where supported — there's nothing to phish and nothing to brute-force. Adoption is still rolling out in 2026, so use them where offered and a password manager everywhere else.

Conclusion

My tests put hard numbers on what security people have said for years: human-pattern passwords are already burned (up to 13.8M breaches for one I tested), 8 characters is dead, and 12 random characters is effectively immortal. You don't need to memorize any of it — generate, store, and let a password manager do the work.

How this article was made

• Tested by me (2026-10-18, Ubuntu 24.04, Python 3.12): 5 breach checks via the HaveIBeenPwned k-anonymity API (full results above); 4 password generations via Python's secrets module with entropy and crack-time computed from the outputs. Raw outputs saved from the test run.
• Researched (with sources linked): Hive Systems 2026 Password Table figures; Bitwarden's published feature/pricing page; NIST SP 800-63B guidance.
• AI assistance disclosure: an AI assistant (the author) ran the tests, did the math, and drafted this article. All numbers above come from the actual test run on the stated date; nothing was invented. If you rerun these checks, expect the breach counts to have grown — that's normal.

Test script and raw output

#!/usr/bin/env python3
"""
Password strength test for the UnlockProof article
"How Strong Is Your Password, Really? I Tested 9 Passwords Against 1B+ Breached Records"

What it does:
  1. Checks 5 common passwords against the HaveIBeenPwned Pwned Passwords
     k-anonymity API (only the first 5 chars of the SHA-1 hash leave this
     machine - the API's documented privacy design).
  2. Generates 4 passwords with Python's `secrets` module (one per policy).
  3. Computes entropy (bits = length * log2(charset size)) and crack time
     (seconds = 2^bits / 1e10 guesses-per-second, pessimistic fast-hash
     assumption) for each generated password.

Run: python3 test_passwords.py
"""
import hashlib
import math
import secrets
import string
import sys
import time
import urllib.request

GUESSES_PER_SEC = 1e10  # pessimistic: fast hash (MD5/SHA-1) on strong hardware

COMMON_PASSWORDS = ["qwerty123", "Pakistan123", "admin12345", "Password123!", "letmein2024"]

POLICIES = [
    ("8-char, lowercase only", 8, string.ascii_lowercase),
    ("12-char, mixed letters + digits", 12, string.ascii_letters + string.digits),
    ("16-char, letters + digits + symbols", 16,
     string.ascii_letters + string.digits + "!@#$%^&*"),
]

# Tiny 20-word demo list, to show why the WORD LIST size (not just word count)
# determines passphrase entropy.
DEMO_WORDS = ["apple", "bridge", "cloud", "dance", "eagle", "flame", "grape",
              "house", "island", "jungle", "kite", "lemon", "mountain", "night",
              "ocean", "piano", "queen", "river", "stone", "tiger"]

DICEWARE_WORDS = 7776  # standard Diceware list size


def hibp_count(password):
    sha1 = hashlib.sha1(password.encode("utf-8")).hexdigest().upper()
    prefix, suffix = sha1[:5], sha1[5:]
    req = urllib.request.Request(
        "https://api.pwnedpasswords.com/range/" + prefix,
        headers={"User-Agent": "UnlockProof-password-test"})
    with urllib.request.urlopen(req, timeout=30) as resp:
        body = resp.read().decode("utf-8")
    for line in body.splitlines():
        h, _, count = line.partition(":")
        if h == suffix:
            return int(count)
    return 0


def crack_time_secs(bits):
    return (2 ** bits) / GUESSES_PER_SEC


def human_time(secs):
    if secs < 0.001:
        return f"{secs * 1e6:.1f} microseconds"
    if secs < 1:
        return f"{secs * 1000:.2f} ms"
    if secs < 60:
        return f"{secs:.1f} seconds"
    if secs < 3600:
        return f"{secs / 60:.1f} minutes"
    if secs < 86400:
        return f"{secs / 3600:.2f} hours"
    if secs < 86400 * 365.25:
        return f"{secs / 86400:.2f} days"
    return f"{secs / (86400 * 365.25):,.0f} years"


def main():
    print(f" guesses/sec assumption: {GUESSES_PER_SEC:.0e} (pessimistic, fast hash)")
    print()
    print("== Test 1: common passwords vs HaveIBeenPwned ==")
    for pw in COMMON_PASSWORDS:
        try:
            n = hibp_count(pw)
        except Exception as e:
            print(f"  {pw!r}: API ERROR ({e})")
            continue
        print(f"  {pw!r}: {n:,} breaches")
        time.sleep(1.6)  # be polite to the free API
    print()
    print("== Test 2: generated passwords, measured strength ==")
    for name, length, charset in POLICIES:
        pw = "".join(secrets.choice(charset) for _ in range(length))
        bits = length * math.log2(len(charset))
        secs = crack_time_secs(bits)
        print(f"  policy : {name}")
        print(f"  charset: {len(charset)} | bits: {bits:.2f} | "
              f"crack: {human_time(secs)}")
        print(f"  sample : {pw}")
    print()
    print("== Passphrase demo: 4 words from a 20-word list ==")
    words = [secrets.choice(DEMO_WORDS) for _ in range(4)]
    bits = 4 * math.log2(len(DEMO_WORDS))
    print(f"  sample : {'-'.join(words)}")
    print(f"  bits   : {bits:.2f} | crack: {human_time(crack_time_secs(bits))}")
    print()
    print("== Reference: 4 words from a proper 7,776-word Diceware list ==")
    bits = 4 * math.log2(DICEWARE_WORDS)
    print(f"  bits   : {bits:.2f} | crack: {human_time(crack_time_secs(bits))}")


if __name__ == "__main__":
    sys.exit(main())

 guesses/sec assumption: 1e+10 (pessimistic, fast hash)

== Test 1: common passwords vs HaveIBeenPwned ==
  'qwerty123': 13,871,714 breaches
  'Pakistan123': 644,389 breaches
  'admin12345': 630,808 breaches
  'Password123!': 295,389 breaches
  'letmein2024': 147 breaches

== Test 2: generated passwords, measured strength ==
  policy : 8-char, lowercase only
  charset: 26 | bits: 37.60 | crack: 20.9 seconds
  sample : xfcdejsg
  policy : 12-char, mixed letters + digits
  charset: 62 | bits: 71.45 | crack: 10,223 years
  sample : Y9HiWNolFgHH
  policy : 16-char, letters + digits + symbols
  charset: 70 | bits: 98.07 | crack: 1,053,088,022,207 years
  sample : ww1iVwfAqPzIgix%

== Passphrase demo: 4 words from a 20-word list ==
  sample : river-grape-bridge-mountain
  bits   : 17.29 | crack: 16.0 microseconds

== Reference: 4 words from a proper 7,776-word Diceware list ==
  bits   : 51.70 | crack: 4.23 days