257 Password Statistics for 2026

How many data breaches involve stolen passwords?

Stolen logins still run through a large share of breaches, even as attackers break in more often through software flaws. Verizon's breach dataset is the broadest count, and its 2026 edition changed how first entry is classified, so the fall in credential abuse is not like for like.

1. 1 Credentials 52%
2. 2 Internal 48%
3. 3 Other 33%
4. 4 Secrets 15%

• Credential abuse was the initial access vector in 13% of breaches in Verizon's 2026 DBIR, against 22% in the 2025 edition; Verizon added Pretexting as a vector and says "this value without the addition of Pretexting would have been 16%". (Verizon (2026 DBIR), May 2026)
• The exploitation of vulnerabilities was the most prominent initial access vector in the 2026 DBIR dataset at 31%, up from 20% the year before. (Verizon (2026 DBIR), May 2026)
• Credentials were among the data compromised in 28% of breaches in the 2026 DBIR. (Verizon (2026 DBIR), May 2026)
• In the Basic Web Application Attacks pattern (3,217 incidents, 2,281 with confirmed data disclosure), credentials were the data compromised in 52% of breaches, and Verizon says the use of stolen credentials is "once again" the top action. (Verizon (2026 DBIR), May 2026)
• In breaches at small and medium-sized businesses, credentials were compromised in 31% of cases, and initial access came through exploitation of vulnerabilities (26%), credential abuse (13%) and phishing (9%). (Verizon (2026 DBIR), May 2026)
• Small and medium-sized businesses hit by ransomware had compromised credentials in 38% of cases or unpatched vulnerabilities in edge devices in 29%. (Verizon (2026 DBIR), May 2026)

Verizon's shares are of breaches contributed to its report from around the world. Initial access, use at any stage and data compromised are three separate measures of the same breaches. The 2026 edition added Pretexting as an initial access vector, so its 13% is not comparable with the 22% of the 2025 edition.

How many password attacks are there?

Thousands every second on Microsoft's systems alone, and almost all of them are simple guessing at scale. The figures below are Microsoft's own telemetry and cover only its accounts and customers.

View data table

Tycoon2FA's share of CAPTCHA-gated phishing attacks in Microsoft's telemetry. The share fell in 2026 after law enforcement activity against the group.

Period	Value
Jul 2025	9%
Dec 2025	76%
Jun 2026	12%

• Microsoft says password attacks were down 26% year over year in its reporting period of July 2025 to June 2026. (Microsoft (Digital Defense Report 2026), Oct 2026)
• Password spray attacks account for over 99% of observed cloud initial access efforts, Microsoft's 2026 report says. (Microsoft (Digital Defense Report 2026), Oct 2026)
• Microsoft Defender recorded 124,146,529 password spray alerts in the 180 days from December 2025 to June 2026; adversary-in-the-middle credential phishing was the second most common enabler of cloud identity abuse at 0.15%. (Microsoft (Digital Defense Report 2026), Oct 2026)
• Of the intrusions that began with valid accounts in Microsoft's incident data for July 2025 to June 2026, 52.2% involved follow-on credential theft and another 18.4% involved active password spray campaigns. (Microsoft (Digital Defense Report 2026), Oct 2026)
• Each month from July 2025 to June 2026, between 89% and 96% of the malicious attachments detected by Microsoft Defender for Office 365 sent users to phishing pages or fake sign-in screens built to steal credentials. (Microsoft (Digital Defense Report 2026), Oct 2026)
• The phishing-as-a-service platform Tycoon2FA grew from 9% of CAPTCHA-gated phishing attacks in July 2025 to 76% by December, then fell to 12% by June 2026 after law enforcement activity against the group, on Microsoft's data. (Microsoft (Digital Defense Report 2026), Oct 2026)
• More than 97% of identity attacks were password spray or brute force attacks in Microsoft's alerts for April to June 2025. (Microsoft (Digital Defense Report 2025), Oct 2025)
• Identity-based attacks rose by 32% in the first half of 2025, Microsoft said. (Microsoft (Digital Defense Report 2025), Oct 2025)
• In Microsoft's analysis of 12.2 million accounts in a password spray attack, 45% of login attempts were wrong passwords for valid usernames and only 1.5% used the correct username and password but were blocked by multifactor authentication. (Microsoft (Digital Defense Report 2025), Oct 2025)
• A May 2025 comparison with the Have I Been Pwned database found that 85% of the usernames targeted in spray attacks appeared in known credential leaks, and each compromised username appeared in three separate logs on average. (Microsoft (Digital Defense Report 2025), Oct 2025)
• Research and academic environments accounted for 52% of the password spray attempts Microsoft observed. (Microsoft (Digital Defense Report 2025), Oct 2025)

All figures are Microsoft's own telemetry on its platforms and customers worldwide. Alerts are not unique attacks or victims. The per-second rate for 2024 and the 26% fall in the 2026 report come from different documents and periods and are not joined into one series.

How common is credential stuffing with leaked passwords?

Leaked passwords turn up in a large share of everyday logins, and most attempts that use them come from bots. The evidence comes from network operators measuring their own traffic, so each figure describes one network.

1. 1 Financial services 22%
2. 2 Telecoms and ISPs 18%
3. 3 Computing and IT 17%

• Counting bots as well as people, 52% of all detected authentication requests on Cloudflare's network contained leaked passwords found in its database of over 15 billion records. (Cloudflare (leaked credentials blog 2025), Mar 2025)
• 95% of login attempts involving leaked passwords came from bots, which Cloudflare reads as credential stuffing. (Cloudflare (leaked credentials blog 2025), Mar 2025)
• On WordPress websites behind Cloudflare, 76% of login attempts with leaked passwords succeeded, and 48% of those successful logins were bot-driven. (Cloudflare (leaked credentials blog 2025), Mar 2025)
• Only 5% of login attempts with leaked passwords on those WordPress websites ended with access being denied. (Cloudflare (leaked credentials blog 2025), Mar 2025)
• Bots made up more than 53% of all web traffic in 2025, up from 51% the previous year, in Thales's network data. (Thales (2026 Bad Bot Report release), Apr 2026)
• Financial services accounted for 24% of all bot attacks and 46% of account takeover incidents in Thales's 2026 report. (Thales (2026 Bad Bot Report release), Apr 2026)
• In the 2025 Imperva report, on 2024 data, financial services accounted for 22% of account takeover incidents, followed by telecoms and ISPs with 18% and computing and IT with 17%. (Thales (2025 Imperva Bad Bot Report release), Apr 2025)
• The 2025 Imperva report drew on 13 trillion blocked bad bot requests across thousands of domains. (Thales (2025 Imperva Bad Bot Report release), Apr 2025)
• In its first month, Google's Password Checkup extension scanned 21 million usernames and passwords and flagged over 316,000 as unsafe, 1.5% of the sign-ins scanned. (Google (Password Checkup research 2019), Aug 2019)
• Users reset 26% of the unsafe passwords the extension flagged, and outside the most popular websites they were 2.5 times more likely to reuse vulnerable passwords. (Google (Password Checkup research 2019), Aug 2019)
• The extension warned on sign-ins that matched one of over 4 billion usernames and passwords exposed in third-party breaches, and over 650,000 people took part in the experiment. (Google (Password Checkup research 2019), Aug 2019)

Cloudflare's figures cover free-plan websites with leaked-credential detection from September to November 2024 and count logins, not people. Thales and Imperva report bot requests blocked on their own network, and the shares in the two editions are not presented as a trend. Google's 2019 figures cover people who chose to install its extension.

How many accounts have been exposed in data breaches?

Billions of account records, though far fewer people. Breach collections count an email address once per breach, and several of the best-known files are lists compiled from earlier leaks.

1. 1 Rows 2,692,818,238
2. 2 Unique email and password pairs 1,160,253,228
3. 3 Unique email addresses 772,904,991
4. 4 Unique passwords 21,222,975

• Have I Been Pwned's Pwned Passwords service handles over 18 billion requests a month. (Have I Been Pwned (Pwned Passwords page), Nov 2026)
• A credential stuffing corpus loaded into Have I Been Pwned in November 2025 held 1,957,476,021 unique email addresses. (Troy Hunt (Synthient corpus post), Nov 2025)
• The same corpus held 1.3 billion unique passwords, 625 million of which the service had never seen before. (Troy Hunt (Synthient corpus post), Nov 2025)
• The corpus spanned 32 million different email domains; gmail.com had 394 million unique addresses, and Troy Hunt wrote that 80% of the data had nothing to do with Gmail. (Troy Hunt (Synthient corpus post), Nov 2025)
• Hunt described the corpus as nearly 3 times the size of the previous largest breach loaded into the service, and 2.9 million of its 5.9 million subscribers were in the data. (Troy Hunt (Synthient corpus post), Nov 2025)
• Collection #1, published in January 2019, was a set of email addresses and passwords totalling 2,692,818,238 rows. (Troy Hunt (Collection #1 post), Jan 2019)
• Collection #1 held 1,160,253,228 unique combinations of email address and password and 772,904,991 unique email addresses. (Troy Hunt (Collection #1 post), Jan 2019)
• It contained 21,222,975 unique passwords, which took the Pwned Passwords list to 551,509,767 unique values. (Troy Hunt (Collection #1 post), Jan 2019)
• A stealer-log corpus processed in October 2025 ran to 3.5 terabytes and 23 billion rows, and held 183 million unique email addresses. (Troy Hunt (Synthient stealer logs post), Oct 2025)
• More than 14 million of the addresses in that stealer-log corpus had never surfaced in Have I Been Pwned. (Troy Hunt (Synthient stealer logs post), Oct 2025)
• Pwned Passwords served 17.45 billion requests in 30 days in October 2025, an average of 6,733 a second, peaking at 42,000 a second. (Troy Hunt (Synthient stealer logs post), Oct 2025)
• Rows in Have I Been Pwned's breach table on 14 November 2026 include Synthient Credential Stuffing Threat Data at 2B addresses (added November 2025), Collection #1 at 772.9M, Verifications.io at 763.1M and Onliner Spambot at 711.5M. (Have I Been Pwned (breaches table), Nov 2026)
• Other rows include Data Enrichment Exposure From PDL Customer at 622.2M, Exploit.In at 593.4M, Facebook at 509.5M, Anti Public Combo List at 458M, River City Media Spam List at 393.4M and Combolists Posted to Telegram at 361.5M. (Have I Been Pwned (breaches table), Nov 2026)

These counts are email addresses and rows in breach files, not people. An address that appears in several breaches is counted in each. The Synthient corpus and Collection #1 are lists compiled from earlier breaches, not a new breach of one service. The home page counters and the breach table are live pages, read on 14 November 2026.

How many stolen passwords do criminals trade?

Billions a year, on the counts of the firms that collect them from criminal forums and malware logs. Each firm counts what it has recovered itself, so the totals overlap and cannot be added.

1. 1 6 characters 239,588,682
2. 2 7 characters 152,581,176
3. 3 8 characters 1,077,202,230
4. 4 9 characters 882,149,149
5. 5 10 characters 925,692,295
6. 6 11 characters 672,515,189
7. 7 12 characters 540,238,382

• SpyCloud recaptured over 642.4 million exposed credentials from 13.2 million infostealer malware infections in 2025, an average of 50 per infection. (SpyCloud (2026 Identity Exposure Report release), Mar 2026)
• SpyCloud's 2026 report also counts 28.6 million phished identity records and 8.6 billion stolen cookies and session artifacts. (SpyCloud (2026 Identity Exposure Report release), Mar 2026)
• SpyCloud found 1.1 million password manager master passwords circulating in underground sources. (SpyCloud (2026 Identity Exposure Report release), Mar 2026)
• 80% of exposed corporate credentials and 63% of exposed consumer credentials in SpyCloud's data included a plaintext password. (SpyCloud (2026 Identity Exposure Report), Mar 2026)
• More than 2.8 billion passwords, hashed or otherwise, were posted for sale or free in criminal forums in 2024, Verizon's 2025 DBIR reported. (Verizon (2025 DBIR), Apr 2025)
• 54% of the ransomware victims Verizon examined had their domains show up in at least one infostealer log or marketplace posting, and 40% of those logs contained corporate email addresses. (Verizon (2025 DBIR), Apr 2025)
• 46% of the systems compromised by an infostealer that held possible corporate login data were non-managed devices. (Verizon (2025 DBIR), Apr 2025)
• 27% of ransomware victims in the 2026 DBIR had no infostealer or credential leak linked to them within the year; of those that did, 50% had one within 95 days before the ransomware attack. (Verizon (2026 DBIR), May 2026)
• Small organisations in that dataset had a median of seven credential leak events over the year, while larger organisations faced around 20. (Verizon (2026 DBIR), May 2026)
• Specops captured and analysed over six billion passwords stolen by malware between January and December 2025. (Specops (Breached Password Report 2026), Jan 2026)
• LummaC2 was the top credential-stealing malware of 2025 in Specops's data, with 60,934,662 credentials compromised. (Specops (Breached Password Report 2026), Jan 2026)
• By length, 1,077,202,230 of the malware-stolen passwords Specops analysed had 8 characters, 925,692,295 had 10 and 882,149,149 had 9. (Specops (Breached Password Report 2026), Jan 2026)
• A further 672,515,189 had 11 characters, 540,238,382 had 12, 239,588,682 had 6 and 152,581,176 had 7. (Specops (Breached Password Report 2026), Jan 2026)
• More than 4.4 billion of the stolen passwords in Specops's data were between eight and twelve characters long. (Specops (Breached Password Report 2026), Jan 2026)

SpyCloud and Specops are security firms reporting data they recovered themselves; Verizon reports data from the contributors to its breach report. All three count records or passwords, not people, and one stolen password can sit in more than one collection. SpyCloud's press release and report give different counts for individual common passwords, so those are left out.

What are the most common passwords?

Runs of digits, starting with 123456, in both a UK government analysis of breach data and a security firm's 2025 collection of malware-stolen passwords. The two lists come from different data and years and are given separately.

1. 1 123456 23.2m
2. 2 123456789 7.7m
3. 3 qwerty 3.8m
4. 4 password 3.6m
5. 5 1111111 3.1m

• After 123456, the next entries in the NCSC's list of passwords in breached accounts worldwide were 123456789 (7.7m), qwerty (3.8m), password (3.6m) and 1111111 (3.1m). (NCSC (breach analysis 2019), Apr 2019)
• The top 5 passwords stolen by malware in 2025, in Specops's data, were 123456, 123456789, 12345678, admin and Password. (Specops (Breached Password Report 2026), Jan 2026)
• The most common base terms in those stolen passwords were admin, guest, cisco and Hello. (Specops (Breached Password Report 2026), Jan 2026)
• The top three stolen 12-character passwords in Specops's data were Password@123, Pakistan@123 and admintelecom. (Specops (Breached Password Report 2026), Jan 2026)

The NCSC counted accounts in breach data held by Have I Been Pwned and published the list in 2019; it is the UK government's own analysis and has not been updated. Specops is a security firm and its list covers passwords stolen by malware in 2025. Other vendors' annual lists could not be checked on the producer's page and are left out.

How long does it take to crack a password?

Centuries for a truly random password behind a slow hash, and seconds for a predictable one, on Hive Systems' modelled estimates. Verizon's scans of company directories find already compromised passwords far more often than weak ones.

View data table

Hive Systems' modelled time, in years, to brute-force a random 8-character password with numbers, upper- and lowercase letters and symbols, hashed with bcrypt at work factor 10. The 2026 estimate assumes a rented fleet of 2 x 8 RTX 5090 graphics cards.

Period	Value
2024	225 years
2025	164 years
2026	132 years

• In Hive Systems' 2026 table, 8 random lowercase letters fall in about two weeks, and Hive says a common, reused or dictionary-based password "can fall instantly". (Hive Systems (2026 Password Table), Jul 2026)
• Hive's estimate for a random 8-character password with the full mix of characters was 225 years in 2024 and 164 years in 2025, with the same password and hash every year. (Hive Systems (2026 Password Table), Jul 2026)
• Hive says crack times have been falling by roughly a fifth to a quarter, year over year. (Hive Systems (2026 Password Table), Jul 2026)
• On a single rented RTX 5090, a bcrypt-protected password like "o#mA24ft" cracked in about three seconds in Hive's test when the attacker tried predictable guesses first. (Hive Systems (2026 Password Table), Jul 2026)
• Hive estimates that eight NVIDIA A100 data-centre GPUs crack an 8-character password of upper- and lowercase letters in about 52 years, against 23 years for eight RTX 5090 gaming cards. (Hive Systems (2026 Password Table), Jul 2026)
• Users are more than four times more likely to use an already compromised password than a "weak" password, Verizon found in scans of organisations' Active Directory accounts. (Verizon (2026 DBIR), May 2026)
• The median share of scanned accounts with breached passwords was 4%, and the median share of Active Directory user accounts not meeting complexity requirements was less than 1%. (Verizon (2026 DBIR), May 2026)
• The most common failed password checks on assessed devices were the number of failed login attempts before lockout (97% of devices) and passwords requiring 15 characters or more (90%). (Verizon (2026 DBIR), May 2026)
• For weak passwords and permission misconfigurations at third-party organisations, it took almost eight months to resolve 50% of findings. (Verizon (2026 DBIR), May 2026)
• Only 3% of the unique passwords in the datasets behind Verizon's 2025 DBIR met complexity requirements. (Verizon (2025 DBIR), Apr 2025)

Hive Systems' times are the firm's own modelled estimates, not measurements of real attacks. They assume a randomly generated password, an offline attack on stolen bcrypt hashes at work factor 10 and the graphics hardware Hive states. Verizon's figures are medians across organisations whose directories or devices were scanned, not a survey of people.

How many people reuse passwords?

It depends on the question. Surveys that ask about any reuse find a majority doing it, while narrower questions and scans of real accounts give far lower shares.

• Same password for multiple, but not all, accounts 52%
• Different password for every account 35%
• Same password for all accounts 13%

• In the same Harris Poll survey for Google, 13% of US adults reused the same password for all their accounts and 35% used a different password for every account. (Google and Harris Poll (security survey 2019), Feb 2019)
• 39% of US online adults said most of their passwords were the same or very similar, while 57% said they varied them across accounts, in a Pew survey published in January 2017. (Pew Research Center (cybersecurity survey 2017), Jan 2017)
• 41% of US online adults had shared the password to one of their accounts with friends or family, the same Pew survey found. (Pew Research Center (cybersecurity survey 2017), Jan 2017)
• 72% of Gen Z respondents reuse passwords, against 42% of Boomers, in Bitwarden's 2025 survey of over 2,300 employed adults in the US, UK, Australia, Germany, France and Japan. (Bitwarden (World Password Day survey 2025), Apr 2025)
• 79% of Gen Z respondents in that survey believe password reuse is risky, yet 59% reuse an existing password when updating an account with a company that has disclosed a breach. (Bitwarden (World Password Day survey 2025), Apr 2025)
• Bitwarden's 2022 survey found 84% of respondents reusing passwords across more than one site. (Bitwarden (World Password Day survey 2022), 2022)
• In Bitwarden's 2023 survey, 85% reused passwords across multiple sites and 58% relied on memory for their passwords. (Bitwarden (World Password Day survey 2023), 2023)
• In Bitwarden's 2024 survey of 2,400 people in six countries, 36% put personal information into their passwords. (Bitwarden (World Password Day survey 2024), 2024)
• 37% of respondents to the 2024 survey viewed their workplace security habits as risky, with 35% storing passwords insecurely and 39% using weak credentials. (Bitwarden (World Password Day survey 2024), 2024)
• The share of US adults who say they use the same few passwords on all their accounts was 22% in 2022, 21% in 2023 and 18% in 2024, in Security.org's own annual poll. (Security.org (password manager report), Oct 2024)
• 7 in 10 consumers and 4 in 10 corporate users in SpyCloud's exposure data had reused an exposed password. (SpyCloud (2026 Identity Exposure Report), Mar 2026)
• Across organisations whose Active Directory accounts were scanned for Verizon's 2026 DBIR, the median share of users reusing passwords, or having the same password as others, was about 6%. (Verizon (2026 DBIR), May 2026)
• 66% of employees admit to poor password habits, such as using default passwords or reusing one password for several accounts, in 1Password's 2025 survey of 5,200 desk-based workers in six countries. (1Password (Annual Report 2025 release), Oct 2025)

The producers here measure different things. Pew is an independent survey of US internet users. Google commissioned the Harris Poll. Bitwarden, Security.org and 1Password are firms reporting their own surveys, each with its own question. SpyCloud and Verizon report account data, not survey answers. None of the shares is comparable with another, and 1Password's release gives figures by country that conflict with its headline, so only the survey-wide figure is used.

How many people use a password manager?

About a third of US adults, on the two most recent surveys that ask, and younger adults far more than older ones. Memory, the browser and paper are all still widely used.

1. 1 Google Password Manager 32%
2. 2 Apple (iCloud Keychain or Passwords app) 23%
3. 3 LastPass 11%
4. 4 Bitwarden 10%
5. 5 1Password 5%
6. 6 Keeper 3%
7. 7 Dashlane 2%
8. 8 NordPass 1%

• About half of US adults aged 18 to 29 (49%) said they used a password manager in May 2023, against 37% of those aged 30 to 49 and one-quarter or fewer of those 50 and older. (Pew Research Center (data privacy survey 2023), Oct 2023)
• By education, 38% of US adults with a bachelor's degree or more used a password manager, against 34% of those with some college experience and 26% of those with a high school diploma or less. (Pew Research Center (data privacy survey 2023), Oct 2023)
• 12% of US online adults said they ever used password management software in a Pew survey published in January 2017, and only 3% relied on it as their main method. (Pew Research Center (cybersecurity survey 2017), Jan 2017)
• Only 24% of US adults used a password manager in the Harris Poll survey for Google in December 2018. (Google and Harris Poll (security survey 2019), Feb 2019)
• 36% of US adults used a password manager in October 2024, which Security.org puts at 94 million users, up from 34% in 2023 and 21% in 2022, in the firm's own online poll of 1,000 adults. (Security.org (password manager report), Oct 2024)
• Among password manager users in that poll, 32% mainly used Google Password Manager in 2024 and 23% Apple's iCloud Keychain or Passwords app, up from 8% and 7% in 2021. (Security.org (password manager report), Oct 2024)
• LastPass was the primary manager for 11% of users in Security.org's 2024 poll, against 21% in 2021, with Bitwarden at 10% and 1Password at 5%. (Security.org (password manager report), Oct 2024)
• Password manager users were less likely to report identity theft or credential theft in the past year than those without one (17% against 32%) in Security.org's poll, a link that does not show cause. (Security.org (password manager report), Oct 2024)
• Password manager use was 46% among Gen Z, 39% among Millennials and 33% among Gen X in Bitwarden's 2025 survey of employed adults in six countries. (Bitwarden (World Password Day survey 2025), Apr 2025)

Pew's surveys are independent and nationally representative (5,101 US adults in May 2023). Security.org is a review site reporting its own online poll, Google commissioned the Harris Poll and Bitwarden sells a password manager. Their questions, years and samples differ, so the shares are not one series; Pew's 2017 question was put to internet users only.

How many organisations and people use multi-factor authentication?

Fewer than you might expect. Under half of UK businesses require it on the official survey, and identity vendors still find a large minority of work accounts signing in without it.

View data table

Share of UK businesses with any requirement for two-factor authentication on networks or applications, by edition of the official Cyber Security Breaches Survey. Each year comes from the release for that year; the link is to the latest one.

Period	Value
2023	37%
2024	39%
2025	40%
2025/2026	47%

• 38% of UK charities had any requirement for two-factor authentication in the 2025/2026 survey, which was in the field from August to December 2025. (DSIT (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• By size, 79% of medium and 90% of large UK businesses had a two-factor authentication requirement. (DSIT (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• Among UK micro businesses, the share requiring two-factor authentication rose from 35% in 2024/2025 to 43% in 2025/2026. (DSIT (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• For UK charities, the two-factor requirement was 27% in the 2023 survey, 33% in 2024 and 35% in 2025. (DSIT (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• 74% of UK businesses and 56% of charities had a password policy that makes users set strong passwords. (DSIT (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• In earlier editions, the share of UK businesses with such a password policy was 70% (2023), 72% (2024) and 73% (2025); for charities it was 55%, 54% and 57%. (DSIT (Cyber Security Breaches Survey 2025/2026), Apr 2026)

The Cyber Security Breaches Survey is an official statistic: a weighted survey of 2,112 UK businesses and 1,085 charities. It is kept apart from the vendor figures below, which describe each firm's own customers, users or survey respondents. Edition labels are publication years; fieldwork ran in the autumn and winter before.

How much does MFA block?

Most automated and bulk attacks, on the data of the companies that run the accounts, but not every takeover. Each claim below is tied to one company's accounts and one way of measuring, and the wording is the producer's own.

1. 1 SMS code: automated bots 100%
2. 2 SMS code: bulk phishing 96%
3. 3 SMS code: targeted attacks 76%
4. 4 On-device prompt: automated bots 100%
5. 5 On-device prompt: bulk phishing 99%
6. 6 On-device prompt: targeted attacks 90%

• In cases of leaked credentials, the same Microsoft study found that MFA reduces the risk of compromise by 98.56%. (Microsoft (MFA study 2023), May 2023)
• Over 99.99% of MFA-enabled accounts remained secure during the study's investigation period. (Microsoft (MFA study 2023), May 2023)
• The Microsoft study found SMS was 40.8% less effective than Microsoft Authenticator. (Microsoft (MFA study 2023), May 2023)
• Microsoft's Digital Defense Report of October 2025 says multifactor authentication "still blocks over 99% of unauthorized access attempts". (Microsoft (Digital Defense Report 2025), Oct 2025)
• A Microsoft Azure post of September 2025 says Microsoft research shows that MFA "can block more than 99.2% of account compromise attacks". (Microsoft (Azure MFA blog 2025), Sep 2025)
• In Google's 2019 research on its own accounts, an SMS code sent to a recovery phone number helped block 100% of automated bots, 96% of bulk phishing attacks and 76% of targeted attacks. (Google (account hygiene research 2019), May 2019)
• On-device prompts helped prevent 100% of automated bots, 99% of bulk phishing attacks and 90% of targeted attacks in the same Google research. (Google (account hygiene research 2019), May 2019)
• Google saw a 50% decrease in accounts being compromised among the users it had auto-enrolled in 2-Step Verification. (Google (2-Step Verification blog 2022), Feb 2022)
• 99% of organisations in Proofpoint's customer base of 50M+ accounts were targeted by account takeover threats between November 2024 and November 2025, and 67% were successfully compromised. (Proofpoint (account takeover blog 2026), Feb 2026)
• Of the organisations hit by one or more account takeovers, Proofpoint says, "59% had MFA enabled on compromised accounts". (Proofpoint (account takeover blog 2026), Feb 2026)
• Of 15,000 push-based MFA attacks Cisco catalogued from June 2023 to May 2024, 5% of the push attacks sent were accepted by users. (Cisco Talos (MFA bypass blog 2024), Jun 2024)
• In Cisco Talos incident response engagements in the first quarter of 2024, users accepting fraudulent MFA push notifications were the underlying cause in 25% and a lack of proper MFA implementation in 21%. (Cisco Talos (MFA bypass blog 2024), Jun 2024)
• In Microsoft 365 attacks focused on bypassing MFA, token theft was the most popular method at 31%, and suspicious logins were present in almost 40% of the attacks, in managed security services data in Verizon's 2025 DBIR. (Verizon (2025 DBIR), Apr 2025)
• MFA was lacking in 59% of the cases in Sophos's 2026 Active Adversary Report. (Sophos (Active Adversary Report 2026), Feb 2026)
• The share of Sophos incident response victims without MFA configured went from 22% in 2022 to 63% in 2024. (Sophos (Active Adversary Report 2025), 2025)
• The top causes of identity breaches named by 650 IT and security leaders in Cisco Duo's 2025 survey were weak or missing MFA (36%), coverage gaps (34%) and one-time passcode failures (29%). (Cisco Duo (identity security survey 2025), Aug 2025)
• Over half (51%) of the organisations in the Duo survey had suffered financial losses due to identity-related breaches. (Cisco Duo (identity security survey 2025), Aug 2025)

Microsoft's figures describe its own accounts. The 2023 study is an observational study of commercial Azure Active Directory accounts with suspicious activity, and the two later Microsoft documents use their own wording, quoted here as printed and not reconciled. Proofpoint measures something different: among its customers that suffered a takeover, how many had MFA switched on for the compromised accounts. That is not an opposing estimate of the rate Microsoft reports. Google's research dates from 2019 and covers Google accounts.

How many people use passkeys?

Hundreds of millions of accounts now hold one, and on the services that report to the FIDO Alliance more than a third of successful sign-ins use a passkey. Every count comes from a platform or an industry body with a stake in passkeys, so read each as that producer's own data.

1. 1 Global 75%
2. 2 Asia-Pacific 77%
3. 3 US 74%
4. 4 Europe 70%
5. 5 UK 77%
6. 6 Germany 70%
7. 7 France 64%

• 38% of all active accounts at the Passkey Index participants had a passkey enrolled in 2026, against 34% in 2025, and 90% of active accounts were eligible for passkeys. (FIDO Alliance (Passkey Index 2026), Oct 2026)
• Passkey sign-ins succeeded 93% of the time at those services, against 78% for traditional MFA sign-ins. (FIDO Alliance (Passkey Index 2026), Oct 2026)
• Signing in with a passkey was 2.8 times faster than signing in without one and saved users an average of 27 seconds per sign-in. (FIDO Alliance (Passkey Index 2026), Oct 2026)
• 9 of the 13 Passkey Index participants that answered plan to implement passwordless accounts in the next 12 months. (FIDO Alliance (Passkey Index 2026), Oct 2026)
• The 2025 Passkey Index put a passkey sign-in at 8.5 seconds, against 31.2 seconds with traditional MFA, a 73% decrease in login time. (FIDO Alliance (Passkey Index 2025), Oct 2025)
• Participants in the 2025 index reported up to an 81% reduction in sign-in-related help desk incidents. (FIDO Alliance (Passkey Index 2025), Oct 2025)
• 90% of consumers in the FIDO Alliance's 2026 survey of 11,000 adults in 10 countries were familiar with passkeys, and 75% had enabled them on at least some accounts. (FIDO Alliance (State of Passkeys 2026), May 2026)
• 40% of the consumers surveyed had enabled passkeys on most of their accounts and 35% on a few. (FIDO Alliance (State of Passkeys 2026), May 2026)
• By region, 74% of US consumers had enabled passkeys on at least some accounts, 70% in Europe and 77% in Asia-Pacific; the UK (77%) was ahead of France (64%) and Germany (70%). (FIDO Alliance (State of Passkeys 2026), May 2026)
• In the FIDO Alliance's 2025 poll of 1,389 adults in the US, UK, China, South Korea and Japan, 75% were aware of passkey technology and 69% had enabled passkeys on one or more accounts. (FIDO Alliance (World Passkey Day 2025 survey), May 2025)
• 48% of the world's top 100 websites had integrated passkey support, the FIDO Alliance said in May 2025. (FIDO Alliance (World Passkey Day 2025 survey), May 2025)
• Google said in May 2024 that passkeys had been used to authenticate users more than 1 billion times across over 400 million Google Accounts. (Google (passkeys blog 2024), May 2024)
• Amazon says signing in with a passkey is six times faster than using a traditional password. (Amazon (passkeys article), Oct 2026)
• Microsoft account users signing in with passkeys succeed about 98% of the time, against 32% for password users. (Microsoft (passkeys blog 2025), May 2025)
• Microsoft says passkey sign-ins are eight times faster than a password and multifactor authentication, and that it sees nearly a million passkeys registered every day. (Microsoft (passkeys blog 2025), May 2025)
• New Microsoft accounts have been "passwordless by default" since May 2025, and Microsoft says a passwordless-preferred sign-in reduced password use by over 20% in its experiments. (Microsoft (passkeys blog 2025), May 2025)
• Monthly passkey authentications by Dashlane users went from 200,000 in the firm's 2024 report to 1.3 million in 2025 and 2.5 million in 2026. (Dashlane (Passkey Power 20, 2026), Oct 2026)
• The share of Dashlane users with at least one passkey was 20% in the 2024 report, 40% in 2025 and 57% in 2026. (Dashlane (Passkey Power 20, 2026), Oct 2026)
• Google leads Dashlane's 2026 ranking at 28% of authentications using passkeys, which Dashlane reads as roughly seven in ten logins there still not using one. (Dashlane (Passkey Power 20, 2026), Oct 2026)
• 45% of respondents to Bitwarden's 2024 survey were adopting passkeys, while 41% said they were "not very well informed" or "not at all" informed about their privacy and security benefits. (Bitwarden (World Password Day survey 2024), 2024)

The FIDO Alliance is the industry body that promotes passkeys. Its Passkey Index is an unweighted average of operating data from 15 consumer services in 2026 and 9 in 2025, so FIDO calls the year-on-year change directional. Its consumer figures come from surveys it commissioned, and the 2025 and 2026 surveys used different samples and methods, so they are not one series. Google, Amazon, Microsoft and Dashlane report their own accounts or users, and Bitwarden its own survey. None of these is a share of all sign-ins worldwide.

How far have employers moved away from passwords?

Most large organisations say they are rolling out passkeys, but a password is still part of the main sign-in at more than half of them. Okta's customer data shows the same gap: nearly every workforce user still signs in with a password.

1. 1 Passkey-based method 30%
2. 2 Password plus authenticator app 28%
3. 3 Password plus SMS or email code 18%
4. 4 Password only 11%

• 68% of organisations with 500 or more employees in 10 countries had deployed, were deploying or were actively piloting passkeys in April 2026; in the US the share was 72%. (FIDO Alliance (State of Passkeys 2026), May 2026)
• 57% of those organisations reported a phishable authentication method as the primary day-to-day sign-in for employees: 28% password plus authenticator app, 18% password plus SMS or email one-time code and 11% password only. (FIDO Alliance (State of Passkeys 2026), May 2026)
• 30% of the organisations surveyed reported a passkey-based method as the primary sign-in. (FIDO Alliance (State of Passkeys 2026), May 2026)
• 28% said fully passwordless sign-in was already in place across most of the workforce: 37% in the US, nearly double the European figure of 21%. (FIDO Alliance (State of Passkeys 2026), May 2026)
• 29% called fully passwordless sign-in a short-term goal for the next 6 to 12 months and 25% a longer-term goal for the next 1 to 3 years; 82% had reached it or were actively pursuing it. (FIDO Alliance (State of Passkeys 2026), May 2026)
• The top driver was stronger protection against phishing and MFA fatigue, named by 39% of organisations and by 46% in the US. (FIDO Alliance (State of Passkeys 2026), May 2026)
• Among organisations that had begun a passkey rollout, 47% reported improved security confidence, 45% faster employee login times, 35% fewer help desk tickets for password resets and 32% fewer phishing-related incidents. (FIDO Alliance (State of Passkeys 2026), May 2026)
• Among organisations not yet fully passwordless, the reasons given were that passwords plus MFA is considered sufficient for now (16%), compatibility with legacy systems (16%) and account recovery (16%). (FIDO Alliance (State of Passkeys 2026), May 2026)
• The share of Okta workforce users with phishing-resistant authenticators rose from 8.6% to 14.0% in one year, and the share using Okta's own FastPass from 6.7% to 13.3%. (Okta (Secure Sign-in Trends 2025), Dec 2025)
• Use of SMS among Okta's workforce users fell from 17.5% to 15.3%, and password use from 95.1% to 93.0% of users. (Okta (Secure Sign-in Trends 2025), Dec 2025)
• 7% of Okta's workforce users did not use a password for any sign-in in January 2025. (Okta (Secure Sign-in Trends 2025), Dec 2025)
• 89% of the security and IT professionals in 1Password's 2025 survey said their company was encouraging employees to shift logins to passkeys. (1Password (Annual Report 2025 release), Oct 2025)
• 61% of the IT and security leaders in Cisco Duo's 2025 survey want to go passwordless. (Cisco Duo (identity security survey 2025), Aug 2025)

The FIDO Alliance figures are self-reported by 1,400 IT decision-makers in a survey the industry body commissioned. Okta reports its own workforce customers, and FastPass is Okta's own product. 1Password and Cisco Duo report their own surveys.

How many people have had an online account taken over?

About three in ten American adults say it has happened to them at some point, on Pew's 2025 survey, and younger adults report it more than older ones. Complaint and case counts from the FBI and UK fraud bodies count only what is reported to them.

1. 1 Ages 18-29 35%
2. 2 Ages 30-49 34%
3. 3 Ages 50-64 26%
4. 4 Ages 65+ 23%

• 8% of US adults said a personal online account had been taken over or accessed without their permission in the past 12 months, and 21% more than 12 months ago, in Pew's survey of 14 to 20 April 2025. (Pew Research Center (scams survey 2025), Jul 2025)
• By age, 35% of US adults aged 18 to 29 and 34% of those aged 30 to 49 had ever had an account taken over, against 26% of those aged 50 to 64 and 23% of those 65 and older. (Pew Research Center (scams survey 2025), Jul 2025)
• The share was 36% among Black adults, 35% among Hispanic adults, 27% among White adults and 26% among Asian adults, an estimate that covers English speakers only. (Pew Research Center (scams survey 2025), Jul 2025)
• By income, 34% of lower-income, 28% of middle-income and 26% of upper-income US adults said an account had been taken over. (Pew Research Center (scams survey 2025), Jul 2025)
• 11% of US adults said someone had taken over their email or social media account without permission in the 12 months before Pew's May 2023 survey; among Black adults the share was 20%. (Pew Research Center (data privacy survey 2023), Oct 2023)
• One-third (33%) of consumers in the FIDO Alliance's 2026 survey of 10 countries had a confirmed account compromise or received a breach notification in the past year: 41% in the US, 31% in Europe and 30% in Asia-Pacific. (FIDO Alliance (State of Passkeys 2026), May 2026)
• 36% of respondents to the FIDO Alliance's 2025 poll said they had had at least one account compromised due to weak or stolen passwords. (FIDO Alliance (World Passkey Day 2025 survey), May 2025)
• 29% of US adults had their identity or login credentials stolen in the past year, in Security.org's own poll of October 2024. (Security.org (password manager report), Oct 2024)
• The FBI's Internet Crime Complaint Center logged approximately 4,700 complaints, with $359.7 million in losses, about account takeover fraud through impersonation of financial institution support in 2025. (FBI IC3 (2025 report), Apr 2026)
• IC3 received 191,561 phishing or spoofing complaints in 2025, against 193,407 in 2024 and 298,878 in 2023. (FBI IC3 (2025 report), Apr 2026)
• Losses reported in phishing or spoofing complaints to IC3 were $215,843,126 in 2025, $70,013,036 in 2024 and $18,728,550 in 2023. (FBI IC3 (2025 report), Apr 2026)
• Personal data breach complaints to IC3 numbered 67,456 in 2025, 64,882 in 2024 and 55,851 in 2023, with reported losses of $1,314,923,988, $1,453,296,303 and $744,219,879. (FBI IC3 (2025 report), Apr 2026)

Pew's surveys are independent and nationally representative, and count people, not accounts. The FIDO Alliance and Security.org report their own surveys with different questions, so their shares are not comparable with Pew's. IC3 figures are complaints filed with the FBI, mostly from the US; they do not measure how often the crime happens.

What do NIST and other authorities now recommend for passwords?

Longer passwords, no forced complexity rules and no routine expiry. These are rules and advice from government bodies, not statistics, and each is quoted from the document that sets it.

• NIST SP 800-63B-4, finalised in July 2025, says verifiers "SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length". (NIST (SP 800-63B-4), Jul 2025)
• Under the same guideline, passwords used only as part of multi-factor authentication may be shorter but must be a minimum of eight characters. (NIST (SP 800-63B-4), Jul 2025)
• The guideline says verifiers "SHOULD permit a maximum password length of at least 64 characters". (NIST (SP 800-63B-4), Jul 2025)
• It says verifiers "SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)". (NIST (SP 800-63B-4), Jul 2025)
• It says verifiers "SHALL NOT require subscribers to change passwords periodically" but "SHALL force a change if there is evidence that the authenticator has been compromised". (NIST (SP 800-63B-4), Jul 2025)
• The earlier revision 3 of the guideline said verifiers "SHALL require subscriber-chosen memorized secrets to be at least 8 characters in length" and "SHOULD NOT" impose composition rules or require periodic changes. (NIST (SP 800-63B revision 3), 2017)
• CISA, the US cyber security agency, advises passwords of at least 16 characters, or a memorable phrase of 4 to 7 unrelated words. (CISA (strong passwords guidance), Nov 2026)
• CISA says users who enable MFA are "significantly less likely to get hacked" and that phishing-resistant MFA is the standard to strive for; it gives no percentage. (CISA (MFA guidance), Nov 2026)
• US Office of Management and Budget memorandum M-22-09 of January 2022 requires phishing-resistant MFA for federal agency staff, contractors and partners and says it must be an option for public users. (OMB (memorandum M-22-09), Jan 2022)
• The memorandum told agencies to remove password policies that require special characters and regular password rotation from all systems within one year. (OMB (memorandum M-22-09), Jan 2022)
• On 23 April 2026 the UK's National Cyber Security Centre said it had decided to no longer recommend that individuals use passwords where passkeys are available. (NCSC (passkeys announcement 2026), Apr 2026)
• The NCSC says passkeys are "at least as secure as, and generally more secure than" the strongest password paired with two-step verification, and that passkey logins can be up to eight times faster than a username, password and code. (NCSC (passkeys announcement 2026), Apr 2026)

This section lists guidance, not measurements. NIST's Digital Identity Guidelines are a US federal standard, and revision 4 replaced revision 3. CISA and the NCSC give public advice; CISA's 16-character advice differs from NIST's 15-character minimum for passwords used on their own. The CISA pages are undated and were read on 14 November 2026.

Methodology and sources

Figures come from the organisations that produce each measure. Official statistics: the UK Cyber Security Breaches Survey (DSIT and the Home Office), the Office for National Statistics, the FBI's Internet Crime Complaint Center and Pew Research Center's surveys. Public bodies: ENISA, NIST, CISA, the Office of Management and Budget and the UK National Cyber Security Centre. Company data and company surveys: Verizon, Microsoft, Google, Cloudflare, Thales, Okta, IBM, Sophos, Mandiant, Proofpoint, Cisco, SpyCloud, Specops, Amazon, GitHub, Dashlane, Hive Systems, Bitwarden, 1Password, Yubico, Security.org, the FIDO Alliance, Cifas and Have I Been Pwned. Each figure links to the document that published it, with the date, and source labels name the report. Company figures describe that company's own customers, network or survey respondents and are labelled that way; they are kept apart from official statistics, and figures from different producers are never added, averaged or charted together. Where a producer changed its method, the change is stated next to the figure. Cracking times are modelled estimates and guidance items are quoted, not counted as measurements. Figures that could not be checked on the producer's own page are left out, including several vendors' annual lists of common passwords. The page is reviewed monthly.

• 1Password (Annual Report 2025 release) · Oct 2025
• Amazon (passkeys article) · Oct 2026
• Bitwarden (World Password Day survey 2024) · 2024
• Cifas (Fraudscape 2025) · Apr 2025
• Cifas (Fraudscape 2026) · Mar 2026
• CISA (MFA guidance) · Nov 2026
• CISA (strong passwords guidance) · Nov 2026
• Cisco Duo (identity security survey 2025) · Aug 2025
• Cisco Talos (MFA bypass blog 2024) · Jun 2024
• Cloudflare (leaked credentials blog 2025) · Mar 2025
• Dashlane (Passkey Power 20, 2026) · Oct 2026
• DSIT (Cyber Security Breaches Survey 2025/2026) · Apr 2026
• ENISA (2025 threat report) · Oct 2025
• FBI IC3 (2025 report) · Apr 2026
• FIDO Alliance (Passkey Index 2025) · Oct 2025
• FIDO Alliance (Passkey Index 2026) · Oct 2026
• FIDO Alliance (State of Passkeys 2026) · May 2026
• FIDO Alliance (World Passkey Day 2025 survey) · May 2025
• GitHub (2FA blog 2024) · Apr 2024
• Google (2-Step Verification blog 2022) · Feb 2022
• Google (account hygiene research 2019) · May 2019
• Google (passkeys blog 2024) · May 2024
• Google (Password Checkup research 2019) · Aug 2019
• Google and Harris Poll (security survey 2019) · Feb 2019
• Google Cloud (Threat Horizons H1 2026) · 2026
• Have I Been Pwned (breaches table) · Nov 2026
• Have I Been Pwned (home page counters) · Nov 2026
• Have I Been Pwned (Pwned Passwords page) · Nov 2026
• Hive Systems (2026 Password Table) · Jul 2026
• IBM X-Force (Threat Intelligence Index 2026) · Feb 2026
• Mandiant (M-Trends 2026) · Mar 2026
• Microsoft (Azure MFA blog 2025) · Sep 2025
• Microsoft (Digital Defense Report 2025) · Oct 2025
• Microsoft (Digital Defense Report 2026) · Oct 2026
• Microsoft (MFA study 2023) · May 2023
• Microsoft (passkeys blog 2025) · May 2025
• NCSC (breach analysis 2019) · Apr 2019
• NCSC (passkeys announcement 2026) · Apr 2026
• NIST (SP 800-63B revision 3) · 2017
• NIST (SP 800-63B-4) · Jul 2025
• Okta (Secure Sign-in Trends 2025) · Dec 2025
• OMB (memorandum M-22-09) · Jan 2022
• ONS (crime appendix tables, year ending June 2026) · Oct 2026
• ONS (Crime in England and Wales, year ending June 2026) · Oct 2026
• Pew Research Center (cybersecurity survey 2017) · Jan 2017
• Pew Research Center (data privacy survey 2023) · Oct 2023
• Pew Research Center (scams survey 2025) · Jul 2025
• Pew Research Center (scams survey 2025) · Jul 2025
• Pew Research Center (tech knowledge survey 2023) · Aug 2023
• Proofpoint (account takeover blog 2026) · Feb 2026
• Security.org (password manager report) · Oct 2024
• Sophos (Active Adversary Report 2025) · 2025
• Sophos (Active Adversary Report 2026) · Feb 2026
• Specops (Breached Password Report 2026) · Jan 2026
• SpyCloud (2026 Identity Exposure Report release) · Mar 2026
• SpyCloud (2026 Identity Exposure Report) · Mar 2026
• Thales (2025 Imperva Bad Bot Report release) · Apr 2025
• Thales (2026 Bad Bot Report release) · Apr 2026
• Troy Hunt (Collection #1 post) · Jan 2019
• Troy Hunt (Synthient corpus post) · Nov 2025
• Troy Hunt (Synthient stealer logs post) · Oct 2025
• Verizon (2025 DBIR) · Apr 2025
• Verizon (2026 DBIR) · May 2026
• Yubico (authentication survey 2025) · Sep 2025