What are the most common password patterns ? A TLDR answer

I was curious about how similar people think while creating their passwords. How people compose their passwords? What is the common patterns people use the most ?

I am familiar with Kali Linux (the offensive security focused Linux distro), Hashcat, Aircrack-ng, Crunch, .. and many other cracking tools.

The idea 🔗

I thought of a way to compute the most common password patterns (also known as masks). Here is the idea in steps.

• download a huge passwords database (a wordlist) such as rockyou.txt
• replace all uppercase letters with its masking symbol
• replace all lowercase letters with its masking symbol
• replace all digits with its masking symbol
• count each password
• sort them to get the top 10 (or top 50)

simplified masking symbols 🔗

Th popular masking symbols are two character long to be usable around normal letters and digits, but I do not need the masking symbols to be in the same word/mask/pattern with normal letters and symbols and digits, so, no need to make them 2 characters.

If you choose the letter u to be the placeholder for an uppercase letter (capital letter), it is confusing if you use it in a mixed mask such as 012uAbckL. To fix that software developers make it two-letter placeholder ?u as in 012?uAbckL and it can be interpreted/translated successfully to its meaning/reference without any confusion.

But my usage is distinct. I do not use mixed mask. I have mask (pattern) only. So, I will use placeholders or symbols that are single-letter only.

Here is the table of popular mask symbols/placeholders, my simplified mask placeholders, and their meaning/reference.

Manipulating the wordlist 🔗

I downloaded RockYou wordlist from GitHub.

I made a local copy of it to prepare it for manipulations, using this command.

cp ~/Downloads/rockyou.txt ~/Downloads/rockyoumasked.txt

Replace all uppercase letters with its masking symbol u.

sed 's/[A-Z]/u/g' -i ~/Downloads/rockyoumasked.txt

Then, replace all lowercase letters with its masking placeholder l:

sed 's/[a-z]/l/g' -i ~/Downloads/rockyoumasked.txt

Then, replace all digits with its mask placeholder d:

sed 's/[0-9]/d/g' -i ~/Downloads/rockyoumasked.txt

Then replace all spaces with the masking placeholder I chose, n.

sed 's/ /n/g' -i ~/Downloads/rockyoumasked.txt

If the wordlist is using only latin letters, then, you can replace all characters that are not letters nor digits nor a newline nor a space nor a tab space with the symbol placeholder s because we can assume that other characters are symbols.

sed 's/[^a-zA-Z0-9\n\t ]/s/g' -i ~/Downloads/rockyoumasked.txt

If you insist on replacing symbols by identifying them, then replace them with the symbol mask placeholder s, use this command:

sed 's/[!@#$%\^&\*\()_+-=]\[\{}\'";:/?\.>,\<]/s/g' -i ~/Downloads/rockyoumasked.txt

Note: make sure to add all symbols inside the square brackets in the above command.

After converting all passwords inside this huge wordlist into their masks, let’s do some statistics.

count the masks 🔗

I use GNU utils to sort password masks inside the wordlist, then use uniq to get count of each uniq line (the line is just a password mask).

sort ~/Downloads/rockyoumasked.txt | uniq -c > ~/Downloads/passwords_count.txt

I save that statistics of each password mask and its count into a new plain text file called passwords_count.txt as you can see in the command above.

The plain-text file contains password mask count and the password mask itself, but they are not sorted from the most common to less common. So, use the following command to sort masks by the most used.

sort -nr < ~/Downloads/passwords_count.txt > ~/Downloads/passwords_count_sorted.txt

Now, we have a list of most used passwords encoded as masks in a plain text file showing the most common password masks first.

Let’s see the top 10 password masks.

Top 50 used password patterns 🔗

The total count of passwords in the original wordlist is 359,944,739 passwords in one huge plain text file.

The percentage (%) column in the table below is the share of this password mask/pattern to the total passwords in the original file.

All top 50 password patterns combined represent 61% of total passwords created and leaked into the wordlist used (RockYou).

Here are what I noticed:

• people often prefer lowercase letters more than uppercase letters and that’s what I thought too.
• people often prefer lowercase letters more than digits and that’s counterintuitive to me. I thought people would prefer digits and numbers, but today I learned that they don’t.
• people do not include symbols in their passwords.
• the longer the password is, the more it is just lowercase letters only.
• when people create a password with lowercase letters and numbers, they put the numeric digits at the end of the password.
• these patterns and the similarities in them would make it easier to crack passwords because people are more predictable than I thought.

I hope you enjoyed reading this post as much as I enjoyed writing it. If you know a person who can benefit from this information, send them a link of this post. If you want to get notified about new posts, follow me on YouTube , Twitter (x) , LinkedIn , and GitHub .