Update 2018-02-17: The title of this article has changed reflecting new information I have received since publishing. For mor information, I refer to the last paragraph.

A treasure trove of leaked passwords

The API of pwnedpasswords.com is quite remarkable. It not only allows you to fetch the results generally obtained by typing in your e-mail into the browser interface and finding out whether or not you’ve been pwned from the comfort of your shell. It further allows you to very simply check whether a certain password has ever been used in any of the dumps they have, and if so, how often. Since haveibeenpwned.com has collected over 550 millions of these in a multitude of data breaches, odds are your password might be amongst these.

Using the API is straightforward, but the way it is secured so that even pwnedpasswords.com itself doesn’t know precisely which password or even password hash you are checking is ingenious, I highly recommend reading their tutorial. The following R snippet allows for obtaining the number of hits for a vector of passwords:

library(httr)
library(digest)
library(plyr)
library(dplyr)
library(stringr)

popularity <- function(password){
  passw_hash = digest(password, "sha1", serialize = FALSE)
  passw_front = toupper(substr(passw_hash, 1, 5))
  passw_back = toupper(substr(passw_hash, 6, 200))
  hashes = 
    read.table(text = content(GET(paste0("https://api.pwnedpasswords.com/range/", 
                                         passw_front)),
                              encoding = "UTF-8"),
               sep = ":") %>%
    rename(hashes = V1, count = V2) %>%
    filter(hashes == passw_back) %>%
    mutate(password = password) %>%
    select(password, count)
  if(nrow(hashes) == 0){
    hashes <- tibble("password" = password, "count" = 0)
  }
  return(hashes)
}

City names as passwords

Using this function allows us to search through various ranges of passwords. For instance, let’s see how many people have chosen the names of cites in Baden-Württemberg as their passwords¹:

It seems like the city name “stuttgart” appears most often in the password list, yet that is not incredibly surprising, as it is also the largest city. A plot of the number of password hits in relation to the number of inhabitants² looks like this:

The red circle describes the number of inhabitants, the black circle the number of usages as password. The plot was created with ggmap.

Quite obviously, the ratio of “number of uses of city name as password” and “number of inhabitants”, i.e. “Use of City Name as Password per Inhabitant” differs from city to city. It seems like this ratio is higher for the cities Heidelberg and Freiburg, each of which is known for a high quality of living and a very picturesque old town. So, let’s look at some international (and especially British) competition:

In this longer list, the effect of having a famous football team (Liverpool, Manchester) as well as having a famous university in a small city (Oxford, Cambridge and Heidelberg) becomes obvious. In other words, it’s not so much about how many people live in a certain city, but how many people feel a positive connection to that particular city, by loyality of a sports team or by time spent at the university.

Let me conclude this article by pointing out the obvious question: “Can any city beat Liverpool” in this contest? All my manual samples have so far yielded good results, but nothing close to Liverpools numbers, for instance:

Thus, until futher notice, I proclaim hereby that Liverpool is the most popular city in the world (relative to password use per inhabitant).

Update 2018-02-17: Chester has overtaken Liverpool

I published this post on Feburary 8th and have since received feedback concerning the core result of this post (i.e. which city is the most popular), in particular, the following tweet:

Actually, the use of Chester as a password beats Liverpool on the same metric. 117,128 occurrences for a population of 118.200, i.e. 990.9 per 1000 population. cc @CheshireLive

— John Murray (@MurrayData) 11. Februar 2019

@MurrayData is correct of course, “chester” has 117128 occurrences in the data base. “Chester” is not only a city name, however, but also a Christian name, and in particular that of the late lead singer of Linkin Park, Chester Bennington. It is plausible that many of these passwords are disconnected from the city itself. Yet the same argument hoilds for soccer teams as I had already pointed out in my original post, thus I opted to ignore these distortions, and I hereby present the new, updated table: