The DOI matches its Crossref record; 43 of the 43 references it cites were found in a registry or an index.
Zipf’s Law in Passwords
Abstract
Despite three decades of intensive research efforts, it remains an open question as to what is the underlying distribution of user-generated passwords. In this paper, we make a substantial step forward toward understanding this foundational question. By introducing a number of computational statistical techniques and based on 14 large-scale data sets, which consist of 113.3 million real-world passwords, we, for the first time, propose two Zipf-like models (i.e., PDF-Zipf and CDF-Zipf) to characterize the distribution of passwords. More specifically, our PDF-Zipf model can well fit the popular passwords and obtain a coefficient of determination larger than 0.97; our CDF-Zipf model can well fit the entire password data set, with the maximum cumulative distribution function (CDF) deviation between the empirical distribution and the fitted theoretical model being 0.49%~4.59% (on an average 1.85%). With the concrete knowledge of password distributions, we suggest a new metric for measuring the strength of password data sets. Extensive experimental results show the effectiveness and general applicability of the proposed Zipf-like models and security metric.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Power-Law Distributions in Empirical Data
Clauset, A., Shalizi, C. R., & Newman, M. E. J. (2009) · SIAM Review · doi:10.1137/070710111 · Cited by 8,019
Error and attack tolerance of complex networks
Albert, R., Jeong, H., & Barabási, A.-L. (2000) · Nature · doi:10.1038/35019019 · Cited by 7,534
Error and attack tolerance of complex networksPreprint
Albert, R., Jeong, H., & Barabási, A.-Ĺ. (2000) · Cited by 6,554
Power-law distributions in empirical data
Clauset, A. J., Shalizi, C. R., & Newman, M. E. J. (2018) · Figshare · doi:10.1184/r1/6586835.v1 · Cited by 6,504
Newman (2005) · doi:10.1080/00107510500052444 · Cited by 5,749
Password security: a case history
Morris, R., & Thompson, K. (1979) · Communications of the ACM · doi:10.1145/359168.359172 · Cited by 926
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords
Bonneau, J. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.49 · Cited by 687
Password memorability and security: empirical results
Yan, J., Blackwell, A., Anderson, R., & Grant, A. (2004) · IEEE Security & Privacy Magazine · doi:10.1109/msp.2004.81 · Cited by 687
Password Cracking Using Probabilistic Context-Free Grammars
Weir, M., Aggarwal, S., Medeiros, B. D., & Glodek, B. (2009) · 2009 30th IEEE Symposium on Security and Privacy · doi:10.1109/sp.2009.8 · Cited by 524
Fast dictionary attacks on passwords using time-space tradeoff
Narayanan, A., & Shmatikov, V. (2005) · Proceedings of the 12th ACM conference on Computer and communications security · doi:10.1145/1102120.1102168 · Cited by 447
Cited by
Two birds with one stone: two-factor authentication with security beyond conventional bound
Wang, D., & Wang, P. (2016) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2016.2605087 · Cited by 539
Self-citationWang, D., Li, W., & Wang, P. (2018) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2018.2834351 · Cited by 272
Self-citationQiu, S., Wang, D., Xu, G., & Kumari, S. (2020) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2020.3022797 · Cited by 224
Self-citationA survey on methods and challenges in EEG based authentication
Jalaly Bidgoly, A., Jalaly Bidgoly, H., & Arezoumand, Z. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101788 · Cited by 173
Improved ECC-Based Three-Factor Multiserver Authentication Scheme
Wu, T.-Y., Yang, L., Lee, Z., Chen, C.-M., Pan, J.-S., & Islam, S. H. (2021) · Security and Communication Networks · doi:10.1155/2021/6627956 · Cited by 52
Metadata
- Authors
- Wang, D., Cheng, H., Wang, P., Huang, X., & Jian, G.
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2017-11
- Volume
- 12
- Issue
- 11
- Pages
- 2776-2791
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W2734150319
- Cited by
- 499
- References
- 43
- FWCI
- 62.66
- Type
- journal article
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Zipf’s Law in Passwords. https://app.cochat.ai/papers/10.1109/tifs.2017.2721359
- The paper
- Wang, D., Cheng, H., Wang, P., Huang, X., & Jian, G. (2017). Zipf’s Law in Passwords. IEEE Transactions on Information Forensics and Security. https://doi.org/10.1109/tifs.2017.2721359
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
