# Empirical Analysis of Password Reuse and Modification across Online Service

arXiv: https://arxiv.org/abs/1706.01939 · HTML: https://mlsanity.com/paper/1706.01939/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Jun 2017.

## Built on by (most cited first, 1 of 1)

- [SE#PCFG: Semantically Enhanced PCFG for Password Analysis and Cracking](https://mlsanity.com/paper/2306.06824/) (2023)

## Abstract (arXiv)

Leaked passwords from data breaches can pose a serious threat to users if the password is reused elsewhere. With more online services getting breached today, there is still a lack of large-scale quantitative understanding of the risks of password reuse across services. In this paper, we analyze a large collection of 28.8 million users and their 61.5 million passwords across 107 services. We find that 38% of the users have reused exactly the same password across different sites, while 20% have modified an existing password to create new ones. In addition, we find that the password modification patterns are highly consistent across different user demographics, indicating a high predictability. To quantify the risk, we build a new training-based guessing algorithm, and show that more than 16 million password pairs can be cracked within just 10 attempts (30% of the modified passwords and all the reused passwords).