The Dumb Password Report for May 2025

Changes for the May 2025 slightly scary dumb password report are fairly minor. I’ve rearranged the columns to put the frequency and ranking information first, and I’ve truncated really long passwords to make the layout work better. These truncations are marked with [cut]. The number of attempts is up from last month’s 5,375 to 5,695 attempts with 470 unique passwords, fewer uniques than last month. A new attack this month was was one attempt to inject some Java to expose /etc/passwd.

I’ve replaced my login user names with {username}, and names of the site with {site}, old compromised passwords with {compromised} and malware with {malware}. There were also a large number of seemingly random hex strings logged on one site. They’re pretty boring so I’ve collected those as one entry. If you think your username followed by a special character and a year is a secure password, you might be in for a shock. Actually, your user/site name followed by anything is a really bad idea.

These are failed password attempts across my WordPress websites. None of my sites are particularly popular. The amount of real traffic they get is small. So if you have a site and think hackers are ignoring it because few would care, think again. Every site on the net gets attacked like this. Every single one, including yours!

The data is presented in two ways, by frequency and in alphabetical order.

5695 login attempts with 470 different passwords

Back to frequency order.

Frequency table Alphabetical table