1.3 billion leaked passwords, mapped by country: what a global password security index actually shows
An analysis of 1.3 billion breached credentials across 69 countries and institutions found that complexity rules alone don't fix weak passwords, and that government domains score high on structure but stay predictable.
The question: standardised password policies, minimum length, mixed character types, mandatory symbols, have been the default advice for two decades. Do they actually produce secure passwords, or do they produce passwords that merely pass the checklist while remaining easy to guess? Dongho Jeon and HeeSeok Kim set out to measure this at a scale no prior study had attempted: not a handful of leaked sites, but 1.3 billion real, breached passwords spanning 56 countries and 6 institutional domain types.
Why it matters: password reuse and weak passwords remain a leading cause of account compromise. IBM X-Force's 2024 data attributes roughly 30% of security incidents to abuse of valid credentials as an initial access vector, and Verizon's 2024 DBIR puts credential theft at around 24% of initial access actions. Guidance exists, NIST SP 800-63B and equivalent standards, but guidance only helps if it is actually shaping real password behaviour, and until this study, nobody had measured that at global scale with a single consistent method.
What the researchers did. The team drew on the Collection #1 breach, a 2019 leak of more than 2.7 billion credentials, and applied a multi-stage cleaning pipeline (removing entries shorter than 6 or longer than 25 characters, non-ASCII entries, malformed records and duplicates) that retained roughly 1.3 billion records, 48.2% of the original. Each record's domain was classified using country-code top-level domains (a direct, reliable proxy for country, covering 565.6 million records), institutional generic top-level domains such as .gov, .mil and .edu (707.6 million records), and a rule-based attribution framework for ambiguous domains like .com and .net that achieved 96.93% classification confidence by anchoring on dominant local service ecosystems (for example, over 95% of China-attributed .com/.net traffic came from four domestic platforms). This produced 69 comparable targets: 56 countries, 6 institutional domain types, and 7 high-volume global services analysed separately to avoid skewing national results. For every password, the team computed a Password Security Index (PSI), a composite of zxcvbn-estimated crack strength, password length, and log-transformed guess counts, each normalised and averaged, then used k-means clustering to sort the 69 targets into five security tiers.
What they found. Institutional domains, particularly .gov, showed high structural complexity, more mixed-character passwords, longer average length, but remained vulnerable to guessing because the underlying patterns were still predictable (dictionary words, common substitutions, sequential digits) rather than genuinely high-entropy. Regional habits, meanwhile, persistently favoured simple numeric-only or alphabetic-only strings regardless of formal policy. Level 1 (single character-type) and Level 2 (two character-types) patterns were roughly comparably common across the dataset, with lowercase-only passwords averaging 31.35% of a target's passwords and numeric-only passwords averaging 15.60%, both varying enormously by target (lowercase-only ranged as high as 54.44% in some targets). The clearest overall conclusion, stated directly by the authors, is that standard complexity mandates are insufficient on their own: meeting a policy's formal requirements and being resistant to guessing are not the same property.
What this does NOT establish. The underlying password data comes from a breach compiled in 2019; this study analyses passwords in use up to that point, not current 2026 practices, and adoption of password managers, multi-factor authentication, and passkeys has grown substantially since then. Whatever these findings say about password behaviour, they describe a snapshot from several years ago, not the present. The authors are also explicit about a second limit worth repeating in their own words: country and organisation labels in this study are "systematically constructed analytical groupings for large-scale comparison, rather than precise indicators of individual user nationality", meaning a password attributed to a Brazilian domain was not necessarily typed by someone in Brazil. The Password Security Index itself is a new, purpose-built metric introduced in this paper; it has not yet been independently validated against real-world outcomes such as which passwords were actually cracked or which accounts were actually compromised, so its rankings describe relative structural strength within this dataset, not a proven predictor of real breach risk. Finally, leaked-password datasets are drawn from services that were breached, not a random sample of all passwords in use, which is a selection effect inherent to this entire class of research and not specific to this paper.
Bizarus interpretation. The most useful finding here is not the ranking of any single country but the .gov result: an environment where complexity requirements are most likely to be formally enforced still produced passwords that were structurally compliant yet practically guessable. That is direct empirical support for the shift already underway in guidance like NIST SP 800-63B, away from composition rules (uppercase, numbers, symbols) and toward length and passphrase-based approaches, since this study shows composition compliance and actual resistance to guessing can diverge sharply. Organisations relying on "must contain a number, a symbol and an uppercase letter" as their security bar should read this study as a caution: that rule can be satisfied by exactly the kind of predictable substitution patterns (P@ssw0rd-style) that guessing tools like zxcvbn are specifically built to catch.
What remains unanswered. Whether these disparities persist in 2026 given the intervening years of security-awareness campaigns, passwordless authentication rollouts, and password-manager adoption is untested by this data and would require a fresh breach dataset to answer. Whether the Password Security Index actually predicts which accounts get compromised, as opposed to which passwords look structurally weaker, has not yet been tested against real intrusion data. And the study's institutional categories (.gov, .mil, .edu) are almost entirely US-centric by construction, so how public-sector password behaviour compares internationally remains an open question this dataset cannot answer.
Source record. Jeon, D. and Kim, H. Global disparities in password security: An empirical analysis of 1.3 billion credentials using the password security index (PSI). Computers & Security, Volume 166, July 2026, Article 104898. DOI: 10.1016/j.cose.2026.104898. Computers & Security, Computer Science (miscellaneous) category, Q1 (SCImago, 2025). Full text was openly accessible and read in full by Bizarus, not summarised from the abstract alone.