📰 Originally published on SecurityElites — the canonical, fully-updated version of this article. The 2023 Home Security Heroes study ran PassGAN against a database of 15.6 million passwords. The results: 51% cracked in under a minute. 65% cracked in under an hour. 81% cracked within a month. PassGAN isn’t a traditional dictionary attack — it’s a generative adversarial network trained on real leaked passwords that generates novel guesses matching the statistical distribution of how humans actually choose passwords. Those numbers don’t mean 81% of all passwords are crackable. They mean 81% of the passwords in that particular dataset — which represent how real users choose passwords — were crackable. The passwords that weren’t cracked were the randomly generated ones, the long ones, and the ones protected by slow hashing algorithms that limited the guess rate. The ones that were cracked were the human-pattern ones: words with substitutions, words followed by numbers, names plus dates.…