2019 IEEE European Symposium on Security and Privacy Workshops

Comparative Analysis of Three Language Spheres:
Are Linguistic and Cultural Differences Reﬂected in
Password Selection Habits?
Keika Mori

Takuya Watanabe

Yunao Zhou

Waseda University
keika@nsl.cs.waseda.ac.jp

NTT Secure Platform Laboratories
takuya.watanabe.yf@hco.ntt.co.jp

Waseda University
zhouyunao@nsl.cs.waseda.ac.jp

Ayako Akiyama Hasegawa

Mitsuaki Akiyama

Tatsuya Mori

NTT Secure Platform Laboratories
ayako.hasegawa.vg@hco.ntt.co.jp

NTT Secure Platform Laboratories
akiyama@ieee.org

Waseda University / RIKEN AIP / NICT
mori@nsl.cs.waseda.ac.jp

passwords are usually composed of alphanumeric letters1 ,many languages use other letters, such as Chinese characters,
Korean Hangul, or Japanese Hiragana. We believe that such alinguistic difference as well as cultural difference may strongly
affect the password creation processes and the resulting password properties. We also believe that such knowledge on the
linguistic/cultural background of a target may help an attacker
to speed up the password guessing process.
With the above in mind, we aim to understand the propensityof password creation through the lens of language spheres. Our
research questions are as follows:
RQ1 Are linguistic and cultural differences reﬂected inusers’ password habits?
RQ2 If so, do these differences allow attackers to crack
passwords effectively?
To answer RQ1, we adopt a two-fold strategy. We ﬁrst perform an online survey of users from three different language
spheres —Chinese, Japanese, and English— and conduct ananalysis on leaked passwords that seem to belong to eachcountry. Regarding the online survey, to recruit the participantsfrom each language sphere without introducing possible bias
factors, we used three crowdsourcing services that operate ineach respective country. Because we want to highlight thecharacteristics of passwords created by people whose native
languages are different, we made our questionnaires in thethree languages to ensure the native languages reported arecorrect. Note that this approach has some limitations, but
it does provide a better opportunity to recruit participantsin a speciﬁc language sphere. We carried out user surveys
through crowdsourcing services and compared the propensityof password creation processes, such as the use of particular
types of words and their languages, use of random letters,
use of password generator, and the management strategies ofChinese, English, and Japanese users.

Abstract—This work aims to determine the propensity ofpassword creation through the lens of language spheres. To thisend, we consider three different countries/languages, each with adifferent culture: China/Chinese, United Kingdom (UK)/English,
and Japan/Japanese. We ﬁrst employ a user study to verify
whether language and culture are reﬂected in password creation.
We found that users in all three countries prefer to create theirpasswords from base words, and the kinds of words they areincorporated into passwords vary between countries. We thentest whether the ﬁndings obtained through the user study are
reﬂected in a corpus of leaked passwords. We found that users
in China and Japan prefer dates, while users in Japan andthe UK prefer names. We also found that cultural words (e.g.,“sakura” in Japan and “football” in the UK) are frequently used
to create passwords. Finally, we demonstrate that the knowledge
on the linguistic background of targeted users can be exploited
to increase the speed of the password guessing process.
Index Terms—User authentication, Password security, Crosscultural analysis

I. I NTRODUCTION
Despite having several security risks, such as cracking or
massive breaches, passwords are still the primary authentication mechanism and are used in a diverse range of services
because of their simplicity and user-friendliness. The properuse of a password generator/manager is a promising approach
towards securing password-based authentication without sacriﬁcing usability too severely. However, the majority of users
today still rely on their brains to create and store theirpasswords, implying that background knowledge about a user
could be used to attack their password efﬁciently.
There have been several prior studies that have analyzed
large corpora of leaked passwords [16] with the aim of assessing the risks of password cracking. There have been otherstudies that aimed at performing in-depth analyses of password
creation propensity through a user study approach [9], [20],[21], [27], [28]. While prior studies on human-generated passwords have focused on the characteristics of passwords created
by English speakers, there have been few studies that focus
on passwords created by non-native English speakers. While© 2019, Keika Mori. Under license to IEEE.
DOI 10.1109/EuroSPW.2019.00025

1 Although we are aware of some exceptions on this assumption, we omit
this issue due to the space limitations.

159are observed in the leaked password analysis. In Section VI,
we show that the knowledge of the linguistic backgroundof targeted users helps an attacker efﬁciently guess theirpasswords. Section VII discusses the limitations of the work,
possible extensions of the work, and future research directions.
Section VIII concludes the work.

Next, using more than 830 million leaked passwords collected from the three different sources of leaked password
datasets, we tested whether the ﬁndings obtained through theuser study were reﬂected in the corpus of leaked passwords.
The leaked password datasets we obtained for this study
contained pairs of email address and plain passwords. By
applying domain name heuristics to the user email addresses,
we extracted the passwords that are likely associated with users
who belong to one of the three language spheres. To analyze
the passwords of three language spheres, for each language,
we compiled several dictionaries, including ones that containgeneric words with lexical categories, speciﬁc dictionaries for
person names, and patterns of digits such as dates of birth,
telephone numbers, etc. As a collective, these dictionaries
contain a huge volume of words, so we also developed asimple methodology that leverages multiple Bloom ﬁlters tocount the frequencies of words in the password dataset in amemory-efﬁcient manner.
To answer RQ2, we tested whether knowledge on the linguistic/cultural background of targeted users can be exploited
to make the password guessing process faster. To this end,
we leveraged the probabilistic context-free grammar (PCFG)
as a modern password guessing algorithm. We changed thepassword corpus data to train the PCFG model and test how
linguistic differences in the training data affect the password
guessing speed.
Our ﬁndings and main contributions are summarized asfollows:

II. R ELATED W ORKThis section reviews several related works. We ﬁrst show
several studies on the cross-cultural user surveys on security,
which is closely related to our approach. Next, we present
prior user studies on password habits. We then present several
analytical studies on password habits. We compare these priorstudies with ours to clearly highlight our contributions.
A. Cross-Cultural User Surveys on Security
Several studies have been conducted to analyze how thecultural differences are correlated with user behavior or attitude toward security. Harbach et al. [10] and Sawaya et
al. [24] conducted user-based surveys in multiple countries.
To this end, these two research groups attempted to translate
their survey questions into the participants’ native languages.
Harbach et al. [10] aimed at investigating user attitude toward
smartphone unlocking and they found that the level of protection of smartphone data was signiﬁcantly different among
various countries and Japanese participants tended to consider
that their data on their smartphone is sensitive. Sawaya et
al. [24] recruited participants from seven countries, i.e., China,
France, Japan, Korea, Russia, the United Arab Emirates, andthe United States. They investigated security behavior andvarious other factors such as security knowledge and selfconﬁdence in security, and concluded that Asian participants,
especially Japanese, tended to behave less securely.

1 We analysed user-generated passwords from the viewpoint of linguistic and cultural differences. To this end,
we adopted a unique approach – combining a user study
and leaked password analysis.
2 Our online user survey revealed that for the three language spheres we studied, participants reported that morethan 80% of users do not use a password generator/manager in their daily life, and 60% of users make useof speciﬁc words or patterns of digits for their passwords.
For each country, there were speciﬁc tendencies in word
choice for creating passwords.
3 Our large-scale password analysis revealed that some of
the characteristics we found in our user study can beobserved in the leaked passwords, such as combining
several words. On the other hand, we observed thatsome characteristics we found in the user study were notobserved in the leaked password analysis, e.g., use of leetor reordering characters in a word.
4 We demonstrated that knowledge on the linguistic/cultural background of a user can accelerate the password guessing process.

B. User Studies on Password Creation
There have been several studies that have analyzed users’
password habits and choices through online studies or monitoring the behavior on their end devices [9], [20], [27],[28]. These studies attempt to understand users’ password
habits/strategies through both surveys and experimental studies. Wash et al. [28] revealed that people often reuse passwords
across different websites. Pearman et al. identiﬁed several
intrinsic strategies people use when creating and reusing
passwords [20]. Riley et al. [21] conducted a user survey tounderstand users’ practices of password creation and storage.
They asked participants about their habits on the Internet, real
strategies to create a password, and practices they think aresafe. They revealed that users did not employ the best practicethey knew. Ur et al. [27] interviewed 49 participants about
their password creation strategies. In their study, they asked
participants to create passwords for three websites (banking,email, and news website). Not only did they identify users’
misconceptions about strong passwords, but they also foundthat their thoughts on the value of each account were different
from that those assumed in the security research community.

The remainder of this paper is organized as follows: In
Section II, we review related work and compare it with ourstudy. Section III describes the details of the user study weperformed. Section IV presents the methodology and resultsof the large-scale leaked password analysis. In Section V, we
examine whether the ﬁndings obtained through the user study

160

TABLE I
D EMOGRAPHICS OF THE PARTICIPANTS .

In these prior studies, authors recruited English speakers
as the participants of their studies, primarily using US-based
crowdsourcing services such as Amazon MTurk or recruiting
university students. Although the participants may include
non-native English speakers, the studies do not consider the
linguistic/cultural differences of participants, assuming English is the primary language used by all participants. In
our study, we shed light on users rooted in different cultures
or countries and conducted our study across three different
language spheres. Our comparative analysis unveiled that thedifferences of password habits and password creation strategies in those countries are statistically signiﬁcant.

CN
JP
UK

Gender# participants
F: 265 M: 203 O: 1
F: 217 M: 298 O: 1
F: 32 M: 83 O: 1

Age (Years)–19 / 20–29 / 30–39 / 40–49 / 50–59 / 60–
0 / 37 / 52 / 8 / 2 / 0 (%)
3 / 22 / 34 / 29 / 9 / 3 (%)
11 / 89 / 0 / 0 / 0 / 0 (%)

TABLE IIW HAT KIND OF COMPUTING DEVICES DO YOU USE ?
(M ULTIPLE CHOICES ALLOWED .)DevicesPC
Smartphone
TabletC. Analysis of Leaked Passwords

CN (%)93
98
47

JP (%)
9469
19

UK (%)97
93
47

TABLE IIID O YOU HAVE A DEGREE IN COMPUTER SCIENCE OR INFORMATIONSECURITY ? A RE YOU TAKING A DEGREE IN THEM CURRENTLY ?

While large-scale data breaches, especially password leakages, have caused serious risks in terms of identity theft,
ironically, leaked passwords have been used as an irreplaceable
data source for password research and have contributed topassword-security policies. In fact, analyzing leaked passwords is another promising channel to understand user’s
password habit.
In this regard, the closest work to ours is the work doneby Li et al. [16]. They analyzed a large corpus of Chinese
web passwords and reported that Chinese speakers prefer
digits and include Pinyin which is a system to representing
Chinese pronunciation with alphabets in their passwords. Zenget al. [30] also investigated Chinese passwords. They studied
the lexical sentiment in passwords and found that users tend touse positive words, especially words representing joy. Whilethey also looked into a non-English password corpus, what
distinguishes their study and ours is that our work is a comparative analysis among three language spheres, rather than being
focused on the property of passwords for services used in asingle language sphere. AlSabah et al. [3] analyzed passwordsof users from different cultural/linguistic backgrounds (Arabs,
Indian and Pakistani, Filipinos, and English speakers). They
used datasets with rich meta-data (i.e., names, phone numbers, emails, addresses, recovery questions and answers) andfound certain differences in passwords of users with different
backgrounds.
Leaked password datasets are used in other lines of research.
Thomas et al. [26] analyzed breached password datasetscollected from various publicly available information sources
such as paste sites, search indexes, public forms, and private
forums. They found that the majority of breached passwords
originated from private forums and 7–25% of stolen passwords
matched a victim’s valid Google account. Das et al. [8]analyzed 6,077 unique user passwords and found that 43–51%
of users reused the same password across multiple sites.

CS Degree
Yes.
No.
Prefer not to say.

CN (%)18
82
0

JP (%)
1090
0

UK (%)
18
82
0

probabilistic context-free grammars (PCFG). Recently, several researchers have proposed using neural network models.
Narayanan et al. was the ﬁrst to propose Markov modelbased password guessing [19], and Ma later studied it morecomprehensively [17]. The advantage of a Markov model isthat it works well for modeling language, i.e., it can predictthe probability of the next character in a password basedon the previously generated characters. Weir et al. produced
PCFG to model the structures of passwords based on theirprobability distributions [29]. This represents passwords as
word-mangling templates and terminals and generates guesses
in highest probability order. It achieves an improvement overJohn the Ripper password cracker, ranging from 28–129%
more passwords being cracked. The password guess generatorof PCFG is open-source. Melicher was the ﬁrst to use along short-term memory (LSTM) neural network to extract
password features from hidden semantics within passwords
and make predictions [18].
As a reasonable choice of a modern password guessing
approach, we adopt PCFG, primarily due to its performanceand availability. We note that the aim of our study is not to propose a novel password guessing technique but to test whether
the linguistic/cultural background of users can accelerate theprocess of password guessing.
III. S URVEY OF PASSWORD H ABITSIn this section, we study how users create passwords throughonline surveys. We ﬁrst present the survey design. Next, weshow the descriptive statistics of participants. We then present
the analysis of the password habits of participants.

D. Password Guessing
State-of-the-art password guessing approaches go beyond
naive traditional techniques such as brute force guessing
or dictionary attacks. Modern password guessing approaches
leverage statistical methodologies such as Markov models or

A. Survey Design
We designed the length of the survey to take 10–15 minutes
for each participant. Before starting the survey, we clariﬁed our

161

TABLE IV
H AVE YOU RECEIVED ANY INFORMATION ABOUT THE RISKS OF NOTMANAGING PASSWORD PROPERLY ? (M ULTIPLE CHOICE ALLOWED .)purpose and the usage of the answers. We obtained informed
consent from the participants. For those who agreed to participate in our experiment, we asked the following questions:demographic information, knowledge about password security,
their ways of managing passwords, and habits of password
creation.
Since our survey involves participants from three different
language spheres, we designed our survey so that the difference in language will not affect the survey results. To thisend, we used three different online survey systems widely usedin each country. Our expectation is that users who primarily
speak in their own language may prefer to read and answer thequestions in that language. We required participants that theirﬁrst language should be either Chinese, Japanese, or English.
Regarding the English speakers, we recruited workers only
from the UK by specifying the location of the workers on
Amazon Mechanical Turk. Each participant was offered 0.4–
1.0 USD. The payment was adjusted based on the income levelof each country. To conform with the ethical considerations,
we obtained informed consent from all the participants before
the survey.

Yes, at school.
Yes, at work.
No I haven’t.

CN (%)15
2270

JP (%)1526
65

UK (%)
19
31
56

Fig. 1. How do you create passwords? (Multiple choices allowed.)

B. Descriptive Statistics of Participants
We received 525 responses from China through Sojump, 561
from Japan through Lancers, and 143 from the UK throughAmazon Mechanical Turk. For Lancers and MTurk, we foundthat users under 18 could not use the crowdsourcing service asworkers. Thus, we did not have ethical issues associated withthe age of participants. For Sojump, there was a possibility thatsome workers were under 18; however, we could not determine
the exact ages of participants. Therefore, we removed the answers of Chinese participants under 20; in total 7 participants,
and thus analyzed 469, 516, and 116 responses from China,
Japan, and UK, respectively. Demographics of the participants
are shown in Table I. While the ages of participants werewidespread for China and Japan, the ages of participants
for the UK were biased toward young generation for somereasons that we were not able to control. The description ofdevices they use is shown in Table II. We see that majority ofthe participants use PC across the three countries. Table III
shows the breakdown of participants who have computerscience and/or information security degree. The majority ofthe participants (80–90%) in all the countries do not have sucha background. Table IV shows the breakdown of participants
who have had opportunities to hear about the information
about the risk of poorly created/managed passwords. For thethree countries, majority of the participants reported that they
have not received such information, indicating that it is naturalthat many of users rely on bad habit of creating/managing
passwords.

Fig. 2. How do you come up with a password? (Multiple choices allowed.)

languages. We expect that these factors are correlated withthe linguistic/cultural differences of language spheres as wellas the weakness of the passwords.
Password Creation Approaches We asked the participants
how they created their passwords; they were given fourchoices: “think by themselves”, “use password generator”,“use initial passwords”, and “others.” These choices are
based on previous works focusing on users password-creation
habits [27]. We asked the participants who answered “other”
to describe the strategy. Figure 1 presents the results. We
see that “Think by themselves,” which is prone to be
cracked in most cases, was the most common password
creation approach in all the three language spheres. The
use of password generator has not been a primary method
for password creation in the three countries; among them,
the UK had the highest adoption rate of 16.4%. We also
notice that Chinese and Japanese methods of creating
passwords were similar with each other, while English
ones were different, which was proved to be statisticallysigniﬁcant with the Chi-square test (signiﬁcance level of 0.01).

C. Password Habits
Password Composition Process
Next, to those who answered that they create passwords bythemselves, we asked their thinking processes. The result isshown in Figure 2. Here, we see clear differences among the

We now present the results of the structured questionnaire,
which aims at studying how a user creates passwords.
Speciﬁcally, we studied, password creation approaches, thepassword composition process, words used for passwords and162

TABLE VI
I F YOU CREATE PASSWORDS FROM BASE WORDS OR SENTENCES , WHATLANGUAGE DO YOU USE ? (M ULTIPLE CHOICES ALLOWED .)TABLE VW HAT WORDS OR NUMBERS DO YOU USE ? (M ULTIPLE CHOICESALLOWED .)CN (%) JP (%)
Personal words
First name
43
23
38
17
Last name36
24
Nickname
Birthday44
17
29
2
Phone number
Credit card
72
197
Person you love
39
13
Important date
Generic words
Famous person
19
13
9
11
Website namePlace name
12
9
19
1
Love word
Music word
15
10
9
5
Sport word
10
7
Animal word

UK (%)
Prefer CN
Prefer JP
Prefer EN
Prefer others

3
0
13
6
7
0
7
10

CN (%)73
062
2

JP (%)
071
61
7

UK (%)00
94
13

TABLE VII
VOLUMES OF THE LEAKED PASSWORD DATASETS USED IN OUR STUDY.
Dataset
Exploit.in
7k7k
人人网

7
1
12
3
20
6
16

Amount805,499,579
19,138,452
4,768,600

Web service–
Game
Social media

study whether dictionary words, meaningful digits, or personal
words are included in the leaked passwords. We also study
which language is commonly used and what kind of mangling
rule was frequently used in the real world. As our password
corpus and dictionaries were huge, we leveraged Bloom ﬁlters
to process the enormous number of words.

language spheres. While “choosing characters randomly” wasnot a common strategy in English and Japanese, it was ascommon as “choosing words” in Chinese. Among those who
create passwords by “choosing characters randomly”, using acharacter which they came up with suddenly or picking up acharacter from each word are common.

A. Dataset
Our dataset included sets of email addresses and passwords
that were leaked from multiple websites. As these lists containemail address– password pairs, they can be used for an attack
called “credential stufﬁng.” In late 2016, a large corpus called“Exploit.in” including email addresses and passwords fromvarious websites appeared in public [12]. The “Exploit.in”
dataset contains nearly 600 million unique email address–
password pairs. In addition to “Exploit.in”, we use other lists
that were leaked from two Chinese websites called “7k7k” [1]and “人人网” [13], which are a gaming site in China and asocial networking site in China, respectively. Table VII shows
the volumes of the datasets we used.

Words Used for Passwords
For those who answered that they create passwords frombase words or numbers, we asked what word they use.
Table V summarizes the results. Again, we see intrinsic
differences among the language spheres. While genericwords such as music words or animal words are preferred
by English participants, personal words such as names
or birthdays were preferred by Chinese and Japaneseparticipants. We note that these differences were statisticallysigniﬁcant with the Chi-square test (the signiﬁcance levelof 0.01). Also, the numbers of users who use personal
words (ﬁrst name, last name, birthday, phone number, credit
number, or address) are statistically different among countries.

B. Associating Passwords with Language Spheres
Using the email address–password pairs, we attempted to
extract passwords that are likely generated by people fromeach language sphere. To this end, we leveraged the domainnames contained in the email addresses. From an email address, we extracted its domain name and checked the audiencegeography of the website with that domain name. We used
the service provided by Alexa Website Trafﬁc, Statistics, andAnalytics [2]. From the audience geography of a domain name,
we can estimate the primary language of the visitors who
access the site. That is, if more than 90% of the visitors arelocated in either of Japan, China, or the UK, we labeled theemail address and password as Japanese, Chinese, or English
data, respectively. As the number of domain names includedin the dataset was large, we limited our search to a set of
top-level domain names (TLDs). Namely, we adopted “.com”,“.org”, and “.net” as the TLDs used in three countries andadopted “.cn”, “.jp”, or “.uk” as the respective TLD country
codes (ccTLDs).

Languages
Finally, we asked the language they use when creating
passwords by themselves. The result is shown in Table VI. As
expected, English participants mostly use English and someother languages such as Arabic, Norwegian, Tamil, and soon. In contrast, Chinese and Japanese participants use both
English and their ﬁrst languages. Such differences may impact
the strategy of selecting effective dictionary when cracking
passwords.
IV. A NALYSIS OF U SER - GENERATED PASSWORDS :L EAKED PASSWORDS A PPROACH
We analyzed leaked passwords to test if participants’ answers in the online survey corresponded to their actual behavior. In this work, we focus our attention on the participants
who reported that they create passwords from base words. We

163

TABLE VIIIN UMBER OF PASSWORDS ANALYZED .
Country
China
Japan
the UK# total5,881,906
462,048388,276# Longer 6
5,720,606
437,147
370,596

Unchanged word?

Yes

G1

Switching the order?

Yes
G2

G5

Adding numbers or
symbols to a word?

Yes
G6

No

No

*Leet word?

Yes
G3

Mixing a word anddigits or symbols?

Yes
G7

No

No
Connecting words ordigits?

No

Yes

No

No

We extracted domain names with the following criteria:
for the domain names under the three ccTLDs, we pickedup the ones that were associated with more than 10 distinct
email addresses. Similarly, for the three TLDs, “.net”, “.edu”,
and “.org”, we picked up the ones associated with more than
100 distinct email addresses, and for domain names under“.com”, we picked up the ones with more than 1,000 distinct
email addresses. Finally, we eliminated the email address–
password pairs, which contained non-ASCII characters. As
a result, 7,761 pairs from Chinese, 39 pairs from Japanese,and 74 pairs from English were eliminated, respectively. In
this way, we obtained sets of email addresses and passwords
classiﬁed by users’ countries. The volumes of data are presented in Table VIII. Previous works have shown that major
services require users to create passwords of six characters or
longer [6], [15], [22]. In this study, we decided to use datathat includes passwords longer than six characters.

Connecting *leetwords or digits?

Yes
G4

Including words or*digits?

Yes
G8

No
Passwords not based on words*: except the passwords consist of digits

Fig. 3. Procedure of the word analysis.

In particular, for the Japanese dataset, we also used namelists in Mecab [23]. Some names have the same spelling as
dictionary nouns. When a password consists of such a word,
we labeled it as a password with a generic word. To check if
a potential name is truly a name or a generic word, we used
words tagged “Temporal Noun (NT)” or “Other Noun (NN)”in Chinese Treebank 8.0, “generic nouns (名詞, 一般)” in
Mecab, and “noun, singular (NN)” or “noun plural (NNS)” in
MASC Sentence Corpus. Regarding “Birth Date” and “Phone
number”, we created regular expressions to check if suchinformation was included in passwords. We do not have users’
personal information, so we just check if passwords include
a date in the range of 1900 to 2099. We checked the following patterns: YYYYMMDD, MMDDYYYY, DDMMYYYY,
YYYY, MMDD, or DDMM. In addition, we check “Credit
card number” by using regular expressions. We preparedregular expressions for the following cards: Amex, BCGlobal,
Carte Blanche, Diners Club, Discover, Insta Payment, JCB,
KoreanLocal, Laser, Maestro, Mastercard, Solo, Switch, Union
Pay, Visa, and Visa Master. As for generic words, we prepareddictionaries of Japanese, Chinese, and English words. We onlyused words that consist of more than three characters. Details
about the dictionaries are presented in Table IX.

C. Extracting Word-based Passwords
To detect word-based passwords, we ﬁrst converted upper
case letters in passwords into lower case letters, and then took
the following two steps. The ﬁrst step was to check mangling
rules and extract words observed in leaked passwords. The second step was to analyze the words (languages and categories of
the words). Our procedure is illustrated in Figure 3. According
to several password properties, we classiﬁed the passwords
into eight groups. To this end, we formulated a rule thatcompiles the heuristics in a mutually exclusive, collectively
exhaustive (MECE) manner.
In Figure 3, G1 is the group of passwords composedof one word including names, dates, phone numbers, credit
card numbers, and words in dictionaries. Passwords that arewords (names or dictionary words) switched the order of thecharacters belonging to G2. Passwords that are words (names
or dictionary words) converted with leet are G3. G4 includes
the passwords of multiple words, and when at least one wordof the multiple words is converted with leet, the password
belongs to G5. When the password is created by adding
numbers or digits to a word, it belongs to G6, and when the
password is a mixture of a word and digits/symbols, it is in G7.
G8 is the group of passwords including words. Each password
belongs to one group and the groups do not overlap anywhere.
1) Dictionaries and Regular Expressions: In Section III,
we found that users prefer to create passwords using words.
“Name”, “Birth Date”, “Phone number”, and “Music words”
were frequently used. We conﬁrmed whether the results corresponded with leaked passwords. We used name lists ofFacebook users [25] to check if passwords included names.

2) Bloom Filter: As shown in Table IX, the size of eachdictionary is relatively large. Therefore, storing all the dictionaries in a memory space requires a large amount of memory
capacity. To address this issue, we leveraged a Bloom ﬁlter,
using which we can make the lookup process scalable. A
Bloom ﬁlter [4] is a data structure consisting of an M -bits
array. All bits are set to 0 at ﬁrst. To insert a word in the164TABLE IX
L IST OF DICTIONARIES USED IN OUR STUDY. T HE “U SED ” COLUMNREFERS TO THE SET OF WORDS THAT ELIMINATES DIGIT- ONLY WORDS
AND ONE / TWO - LETTER WORDS .

Name
ChineseJapanese
EnglishDictionaries
facebook-ﬁrstnames-withcount.txt
facebook-lastnames-withcount.txt
Mecab (tagged as persons’ name)
Chinese Treebank 8.0
Mecab
MASC Tagged Corpus
WordnetTotal #
4,347,667
5,369,437
599,934
114,174
2,394,665
40,286354,117

the UK prefer letters to digits. In the top 10 passwords ofUK users, both generic words (“password”,“liverpool”) andpersonal words (“charlie”,“thomas”) appear. “liverpool” and“chelsea”, which are the names of English football clubs,
were common. Regarding Japanese, they use both lettersand digits. “Sakura” means cherry blossoms in Japanese,and “yokohama” is a city in Japan. “11922960” sounds likethe phrase “いい国作ろう (Let’s make our country great)”,which is related to Japanese history.

Used #
4,346,965
5,368,735
598,106
113,378
2,394,026
32,200353,804

Word-based Passwords

data structure, k hash functions are computed for each word.
The outputs of the hash functions should be smaller than M .
Say we have a word “e” to store in the bloom ﬁlter. First, we
compute k hash functions for the word. Then the bits of index
h1 (e), h2 (e), ... ,hk (e) are set to 1. To check if a word is in the
Bloom ﬁlter, the same process is done for the word. When allbits are set 1, we consider the word to be in it. We do not skip
words, but we may mistakenly detect a word that is not in theﬁlter. By changing the length of the bits array or the numberof hash functions, we can control the false positive rate. We
decided that the false positive rate should be p = 0.000001. Inorder to make the ﬁlter more robust, we adopted a variant of
the Bloom ﬁlter introduced in [7], which prepares a bit arrayfor each hash function. This Bloom ﬁlter ensures that k bits
are set for one word.
3) Mangling Rules: We analyzed the usage rates of “Connecting words”, “Mixing words”, “Switching the orders”,“Leet”, “Unchanged”, and “Adding digits or symbols to aword” in leaked passwords. “Connecting words” is a strategy
of connecting words, names, dates, phone numbers, or credit
numbers, and “Unchanged” is a way of using them as is.
“Adding digits or symbols” means adding digits or symbols
at the beginning or end of a word. “Switching the orders” and“Leet” are common mangling rules and Hashcat [11] supports
these rules. We deﬁne “Switching the orders” as reversing
the word, putting the ﬁrst letter at the end, or putting thelast letter at the beginning. Regarding “Leet”, we checked
for the following replacements: a:4, a:@, b:6, c:<, c:{, e:3,
g:9, i:1, i:!, o:0, q:9, s:5, s:$, t:7, t:+, x:%. For “Mixing
words”, We decided to check passwords that consist of a word
whose characters are surrounded with digits or symbols (e.g.,
p1a2s3s4, 12pa!!ss). Finally, we checked the passwords that
include words. We labeled the passwords as “Include” if we
could not determine the mangling rules.

The fractions of passwords that are likely created frombase words were 41.3%, 80.1%, and 90.2% for Chinese,
Japanese, and the UK, respectively. As Section III showed,
the percentage of word-based passwords is high in Japan andthe UK. The difference in the percentages was statisticallysigniﬁcant in the Chi-squared test (signiﬁcance level of 0.01).
Regarding the languages of the words, native languages are
frequently used. In China and Japan, English words are also
popular (Table XI).
Of the passwords created from base words, we calculated
the percentages of the passwords that use each mangling rule
(Figure 4). The mangling rule most frequently used in China
and the UK was “Unchanged”, and the most popular one inJapan was “Connecting words”. The adoption percentages ofthem were different among countries, and the differences were
statistically signiﬁcant. Of the users who create passwords byconnecting words, 56% in China, 48% in Japan, and 77% in
the UK use two words, and 7% in China, 5% in Japan, and
2% in the UK of them repeat the same word.
In all three countries, “Date”, “Name”, and “Word in
dictionaries” are popular. In spite of user studies showingthat Chinese people tend to use personal information, words
in the dictionary that mainly include generic words are frequently used in Chinese leaked passwords. Also, we observed“Names” in English passwords, while most of the UK participants in our user study did not report that they used people’sname. The use rates of “Names”, “Dates”, and “Phone numbers” were statistically different among countries. We looked
into the words used to create passwords. We only checked
100 frequently used words in passwords that consist of one
word. In Chinese passwords, technical words like “computer”,“internet”, and “system” are frequently used. Also, we foundsome nicknames (e.g., “xiaoxiao”, “yangyang”) in Chinese
passwords. We did not have nickname lists, so these nicknames
were classiﬁed as dictionary words. Comic book characternames (e.g., “doraemon”, “naruto”) are common in Japan, andanimal names (e.g., “monkey”, “elephant”) frequently appear
in English passwords. Also, we found foods like “mufﬁn”
and “cookie” in English passwords. Regarding sports, while
we found various kinds of sports (e.g., “tennis”, “soccer”,“baseball”) in Japanese passwords, only “football”, “cricket”,
and “golfer” appeared in the top 100 frequently used English
words.

D. Analysis of Word-based Passwords
Basic statistics
Password length, structure, and common passwords
are presented in Table X. We used “Password Analysis
and Cracking Toolkit” (PACK) [14] to check the lengthand structure. Similar to the ﬁndings of previous studies,frequently used passwords are “123456” and “password”.
More than half of Chinese passwords consist of only digits,
and the site name “tianya” and “5201314”, which sounds like“我你一生一世 (I love you forever)”, are popular. Users in165

V. C OMPARING U SER S TUDY AND L EAKED PASSWORDSTABLE X
BASIC STATISTICS OF THE LEAKED PASSWORDS .

1
2
3
4
5

1
2
3
4
5

1
2
3
4
5
6
7
8
9
10

Password Length
CN (%)
JP (%)
6 (26)
8 (48)
8 (22)
6 (13)
7 (17)
9 ( 9)
10 (12)7 ( 9)
9 (11)
10 ( 7)
Password Structure
CN (%)
JP (%)
DDDDDD (20)
LLLLLLLL (22)DDDDDDDD (12)DDDDDDDD (7)DDDDDDD (12)LLLLDDDD (5)DDDDDDDDD (4)DDDDDD (4)DDDDDDDDDD (3)LLLLLL (4)Password Ranking
CN (%)
JP (%)
123456 (3.30)
123456 (0.15)
111111 (0.83)
password (0.07)
123456789 (0.52)
123456789 (0.06)
123123 (0.38)
12345678 (0.06)
111222tianya (0.27)
1qaz2wsx (0.05)
12345678 (0.27)
sakura (0.04)
5201314 (0.23)
Exigent (0.04)
super123 (0.22) 1234567890 (0.03)
D1lakiss (0.19)
11922960 (0.03)
123321 (0.15)
yokohama0 (0.03)

In the user study shown in Section III, 56.9%, 63.0%,
and 59.5% of China, Japan, and the UK participants createdpasswords by themselves using base words/digits, respectively.
However, 41.3%, 80.1%, and 90.2% of passwords seemed to
be derived from words or meaningful digits, respectively. As
multiple choices were allowed in the user study, we expected
lower percentages for leaked passwords. Possible reasons forthe results are the false positives of word-detection, users’
unconscious use of words, the differences between servicesof the supposed sites in the user study, and the services ofactual leaked sites.
Languages and Based Words The user study and leaked
passwords correspond to the language they use to create
passwords. Users are most likely to use their native language
in all three countries, and English is also as common as in
China and Japan.
Regarding the categories of the words, as users answeredin our user study, we observed a number of names anddates in the Chinese and Japanese passwords. Also, we foundphone numbers in Chinese leaked passwords. Names are usedfrequently in the UK, but UK users in our user study said they
did not use their personal information. They seem to choose
easy words that can be remembered unconsciously. We could
not see consistency in the choices of generic words. In theuser study, users answered that they were likely to use “Lovewords” or “Music words”. However, we found food names,
names of comic book characters, etc. in leaked passwords.
Only one category appeared in both the user study and leaked
passwords: animal names. To observe word categories, weonly checked passwords that consist of one word. It might
be difﬁcult to ﬁnd “Love words” because they would be usedin combination with other words (e.g., loveyou, love4ever).

UK (%)
8 (26)
6 (22)
7 (16)
9 (14)
10 ( 9)UK (%)LLLLLL (11)
LLLLLLLL (9)LLLLLLL (7)LLLLLLDD (4)LLLLLLLLL (3)UK (%)
password (0.21)123456 (0.21)
charlie (0.14)
liverpool (0.12)
chelsea (0.09)
thomas (0.08)
george (0.07)
charlie1 (0.07)
tigger (0.07)
password1 (0.07)

TABLE XIL ANGUAGES USED IN LEAKED PASSWORDS

Chinese words
Japanese words
English words

CN (%)13
2
9

JP (%)
518
17

UK (%)
3
4
35

China
Japan
UK

Mangling rules

Connect words
Mix words
Switch the order

VI. PASSWORD G UESSING

Leet

In this section, we aim to examine how well attackers
can guess passwords by utilizing the linguistic backgroundof the targeted users. To this end, we tested the following two
scenarios.
• Scenario 1: An attacker knows the linguistic backgroundof their targeted users and can use the password data
leaked from the websites for users in the same language
sphere of the targeted users.
• Scenario 2: An attacker does not know the linguistic
background of targeted users and uses the password data
leaked from websites for users in the various language
spheres.
For comparison’s sake, we further set the following baselines that represent an immature attacker and an idealized
attacker, respectively.
• Baseline 1: An immature attacker who utilizes leaked
passwords that are easily found by anyone on the Internet.
• Baseline 2: An idealized attacker who can perfectly order
guesses of passwords. We compute the metrics named“guesswork,” which was proposed in Ref. [5]; i.e., we

Unchanged
Add digits/symbols
Include
0

10

20

30

40

Percentage(%)

50

Fig. 4. Mangling rules of word-based passwords.

TABLE XIIC ATEGORIES OF WORDS IN WORD - BASED PASSWORDS .

Date
Phone
Credit card
Name
Words in dictionary

CN (%)
26
5
0.02
19
54

JP (%)
17
0.3
0.03
44
48

UK (%)
4
0.1
0.03
33
45

166

N
compute Gα = i=1 pi · i, where pi is the probability
that the i-th most common password is sampled out of
the entire password set.

at Chinese and Japanese passwords. RockYou was a service
provided in English, and it seems that the RockYou dataset
has a similar tendency to the UK one.
Regarding the ﬁrst scenario, comparing the efﬁciency between countries, we found that 5.81% of Chinese passwords,
1.13% of UK ones and 0.48% of Japanese ones were cracked
within 10 guesses. We note that 3.24% of Chinese passwords
are recovered with just one guess. The guessed password was“123456,” which was the most popular password in the Chinese password dataset. As such, Chinese common passwords
are too popular, which is what lead to this result. The results
show that Japanese passwords are relatively difﬁcult to guess.
Japanese prefer connecting letters and digits, and guessing thecorrect combination is laborious. Also, they tend to use various
kinds of words like “Names”, “English words”, and “Japanesewords”. These observations may be the reasons for the result.

A. PCFGPCFG [29] guesses passwords by using rules, which are
generated in the training step or prepared manually. The rules
contain the probabilities of structures appearing in the training
dataset (e.g.,“A6 :0.07”, “A8 :0.06”) and the frequencies of
the character strings (e.g.,“password:0.02”, “sunshine:0.006”).
For scenario 1, we prepared training and test sets for eachcountry. We randomly sampled 150,000 passwords each fortraining sets and test sets to ensure that the numbers of
training/test data from the three countries are the same. For
scenario 2, we randomly sampled 50,000 passwords from three
countries and prepared mixed training and test sets composedof 150,000 passwords. As the baseline 1, we used entire
passwords contained in the “RockYou” dataset for a training
set. Finally, we compiled ﬁve training sets: CN, JP, UK, mixed,
and RockYou, and three test sets: CN, JP, and UK. We createdrules and generated guesses from the corresponding training
set. Each test set is tested three times with guesses from thecorresponding country’s training set, mixed trining set, andRockYou training set.

VII. D ISCUSSION
A. Limitations
One clear limitation of our work is that the ages of the
English participants from the UK were all below 30. Thismight be one of the reasons we see some inconsistency
between the user study and leaked passwords analysis. We
may need to try a different crowd sourcing service (e.g.,
Proliﬁc.ac) to adjust for the potential bias factor. Anotherlimitation of our work is that our dataset was a “combo list”,
which is a compilation of credential data leaked from various
websites, and we do not know the composition requirements
and the scenario based on which the passwords were created.
In general, users’ password creation habits depend on the
password policy or the kinds of service. Therefore, we cannot
conclude that the propensity we found is always consistent.
We also note that two Chinese leaked password sets also had
different password composition policies, implying that it is
not possible to measure/analyze passwords in a cross-culturalmanner given a constraint that all the password sets shouldhave the same password composition policies.

B. Result
We generated 109 of guesses and calculated the percentagesof passwords found in the test sets. We show the results in
Fig 5. We used passwords from each country to train a PCFG
and generated guesses, and then we calculated the percentageof cracked passwords of each country. In the ﬁgures, the solidlines represent the ﬁrst scenario, the dashed lines represent thesecond scenario, the dotted lines represent the baseline 1, andthe baseline 2 is represented by the dash-dotted lines.
Comparing the ﬁrst scenario and the second scenario, we
found that when the PCFG was trained with each country’s
passwords, the speed of cracking passwods was higher thanthose with mixed passwords. We note that the reason why thebaseline 1 (RockYou) outperforms the two scenarios when thenumber of guesses becomes large (say, around 109 ) is likely
associated with the fact that the number of RockYou passwords
we used to train PCFG was huge and much larger than theones for Chinese, Japanese, and UK passwords as shown in
Table XIII.
To crack 10% of the test passwords, the attacker had togenerate 1,018 guesses (for Chinese), 128,727 guesses (forJapanese), and 1,235 guesses (for UK) considering the rules of
mixed passwords. However, only 319 guesses, 71,420 guesses,
and 669 guesses for the respective countries were required
when attackers leverage each country’s passwords; i.e., thepassword guessing process has become faster by leveraging
the knowledge on the language of targeting passwords.This isbecause PCFG learned propensity of password creation like astructure or sequences of characters. When the total number ofguesses is not large, PCFG trained by the RockYou dataset wasgood at guessing UK passwords, but it was poor at guessing

B. Ethics
Our survey included potentially sensitive questions, suchas password creation strategies, password management, etc.
Therefore, we obtained informed consent from all participants
before questioning them. We clariﬁed that they were able toquit anytime, that their responses would be used solely forthis research, and that their privacy will be protected when
the results of this survey are published. The leaked datasets
we analyzed consisted of mail address—password pairs. We
stored all data securely and did not expose them or test thevalidity of the data with real services. We only used them forour research.
C. Future WorkIn this work, we found intrinsic differences among passwords generated by users from multiple-language spheres,and this tendency will help an attacker to guess passwords.
However, we did not investigate why these differences exist

167

TABLE XIIIT RAINING AND TEST SETS FOR PCFG.
CN
Chinese passwords
Japanese passwords
UK passwords
Passwords from RockYou
total

Train
150,00000
0
150,000

JP
Test
150,00000
0
150,000Train
0
150,00000
150,000

UK
Test
0
150,00000
150,000Train0
0
150,0000
150,000

Test
0
0
150,0000
150,000

MIX
Train
Test
50,00050,00050,00050,00050,00050,00000150,000
150,000

RockYouTrain00014,344,391
14,344,391

Fig. 5. The percentage of passwords guessed after a given number of guesses: Chinese (left), Japanese (middle), and UK (right).

majority of users create passwords by themselves based onsome words. The word categories they choose from and theway they mangle the words differed among countries. Finally,
we demonstrated that knowledge of the linguistic backgroundof targeted users contributes to increase the speed of password
guessing process.

in nature. A future could include asking users open-ended
questions and conducting deep analysis. As a step toward
securing human-generated passwords, we require a mechanism
to improve the strength of human-generated password without
sacriﬁcing usability. In the future, studies could determine
better ways to urge users with different cultural backgrounds
to create secure passwords.
While this work focused on the creation of passwords,
extending the study to other topics, such as the management ofpasswords, is the next step toward establishing better password
practices on the basis of language sphere. Conducting researchon password management tools and addressing limitations will
be necessary in future work.
Users in China, Japan, and the UK predominantly use
personal information to create their passwords. It is common that the email addresses (especially for work) include
names. Attackers can obtain both users’ nationalities andtheir personal information from their email addresses, whichhelps attackers to guess passwords effectively. Users should
be urged not to use previously leaked passwords, but it is also
important to educate users in creating passwords that cannot beguessed easily using open data (e.g., email address or personal
information on social media).

IX. ACKNOWLEDGEMENT
We thank our shepherd, Ingolf Becker, for his thoughtful
suggestions and the anonymous reviewers for their fruitfulcomments.
A PPENDIXQ UESTIONNAIRE FOR U SER S URVEY
A. Consent for Participation in the Study
The researcher requests your consent for participation in astudy about password management. This consent form asks
you to allow the researcher to use your comments to enhance
understanding of the topic.
Participation in this study is not forced by anyone. If
you decide not to participate, you can abandon the task atanytime (and will not have rewards for it). Please be awarethat if you decide to participate, you may stop participating
at any time and you may decide not to answer any speciﬁcquestion.
The researcher will maintain the conﬁdentiality of the data.
Any information that is obtained in connection with this study
and that can be identiﬁed with you will remain conﬁdential.
By submitting this form you are indicating that you haveread the description of the study, and that you agree to theterms as described.

VIII. C ONCLUSIONS
Users tend to create and memorize their passwords. Thisway of creating passwords has been studied in Englishspeaking users. In this study, we focused on Chinese-,Japanese-, and English-speaking users from two points ofview: a user survey and leaked passwords analysis. Boththe user study and leaked password data showed that the168

Thank you in advance for your participation!

••

1. I agree to participate in the research study. I understandthe purpose and nature of this study. I understand that I can
withdraw from the study at any time.
• Yes
• No
2. I grant permission for the data generated from this study to
be used in the researcher’s publications on this topic.
• Yes
• No
3. Please check the follwing box to indicate agreement toparticipate in this study.
• I agree

tabletother:[user’s input]

C. Knowledge
12. Did you take a degree in computer science or information security? / Are you taking a degree in them?
• Yes
• No
• Prefer not to say
13. Have you received training on how to manage yourpasswords at work or school?
• Yes. I received training at work.
• Yes. I received training at school.
• No
14. What do you remember from the training?
15. Have you received any information about the risks of notdoing password management?
• Yes. I received at work.
• Yes. I received at school.
• No
16. What information do you remember regarding the risks of
not doing password management?
17. Please choose all passwords you think are safe.
• 0531• iC9p• &y@O• mint• dragon• Ra1nb0w• 5201314• 5ZQTERrg• ’fo[2%8*• dapwIL28• passwd1!
• OdkeDfd!
• iloveyou• mwWprz1YrgcBm1Aq• nJ&uJsh3{(nu”&5D
18. What steps do you take to create a strong password?

B. Demographics
4. How old are you?
• Under 20• 20-29• 30-39• 40-49• 50-59• Older than 60
5. What is your nationality?
6. What is your ﬁrst language?
7. What other languages can you speak?
8. What is your gender?
• Female• Male• Prefer not to say• other:[user’s input]
9. What is your occupation?
• Accounting• Finance• Freelance• Engineering• Health Care
• Government• Sales• Transportation• Student• other:[user’s input]
10. What kind of internet services which require passwords
do you use?
• Social media• Online Shopping• Banking• Email• Streaming Video Service• Payment service• other:[user’s input]
11. What kind of computing devices do you use?
• PC
• smartphone

D. Passwords for important accounts
Please answer the questions about your passwords forimportant accounts. (ex. primary e-mail account)
19. How do you create passwords? Please select all that apply.
a create it myself >Q20
b use a password generator >Q29
c use initial passwords >Q31
d other:[user’s input]
20. How do you create your passwords? [Please answer, if you
answered (a) in Q19.]
a use characters randomlyb use words or numbers
c use sentencesd other169

e mix words or numbers
f connect words or numbers
g other:[user’s input]
26. Please give an example, if you answered (b) in Q20.
(Please don’t choose actual passwords you are using.)
Words/Numbers:[user’s input]
Password:[user’s input]
27. How do you choose sentences? [Please answer, if you
answered (c) in Q20.]
a personal sentence (ex. I went to New York on April
11th.)
b famous quotes (ex. Genius is one percent inspiration andninety-nine percent perspiration.)c general sentence (ex. It is ﬁne today.)d other:[user’s input]
28. Please give an example, if you answered (c) in Q20.
(Please don’t choose actual passwords you are using.)
Sentence:[user’s input]
Password:[user’s input]
29. Please tell us the generation rules. [Please answer, if you
answered (b) in Q19.]• Include Symbols (!, @, #, $...)• Include Numbers (0123...)• Include Lowercase (abc...)• Include Uppercase (ABC...)
Password Length:[user’s input]
30. Please give an example, if you answered (b) in Q19.
(Please don’t choose actual passwords you are using.)
Password:[user’s input]

e other:[user’s input]
21. If you create passwords from base words or sentences,what language do you use? (ex. English, German, French,
Spanish)Language:[user’s input]
22. How do you choose characters? Please select all that apply.
[Please answer, if you answered (a) in Q20.]
a decide a base sentence and choose one character fromeach word from the sentenceb decide some words and choose one character from eachword
c decide a character which you came up with suddenly
d type on your keyboard randomly
e other:[user’s input]
23. Please give an example, if you answered (a) in Q20.
(Please don’t choose actual passwords you are using.)
Password:[user’s input]
If you have base words/numbers/sentences, please tellus.:[user’s input]
24. What words or numbers do you use? [Please answer, if
you answered (b) in Q20.]• your ﬁrst name• your last name• nickname• your birthday• phone number• credit card number• famous person’s name• famous person’s birthday• the person you love• important date(anniversary, and so on)• website name• the date you register the website• time• place name• words related to love• words related to music• words related to sport• words related to your family• words related to animals• pet name• your favorite words• ID numbers for another membership• motto• other
25. How do you randomize the words or the numbers? [Pleaseanswer, if you answered (b) in Q20.]
a use the word itself
b replace certain characters with other characters (ex.
password ->p@ssw0rd, e->3, i->1)
c replacecertainwords/numbers
with
other
numbers/words which have similar sound. (ex. ate->8)d switch the order of each letter/word. (ex. password >drowssap/wordpass)

E. Related information
31. Have you ever had your passwords leaked?
• Yes
• No
• Prefer not to say
32. How did you notice it?
33. What kind of password creation strategies did you used touse?
34. How do you change password creation strategies depending on accounts? (Email/Banking/Game/Shopping...etc)
35. Do you reuse your password?
• I use the same password for all websites.
• I use the same password for websites which provide thesame service.
• I use the same password for websites which provide thedifferent services.
• I use the different passwords for each website.
• other:[user’s input]
36. How many accounts do you have?
• 1
• 2-5
• 6-10• 11-20170

[10] Marian Harbach, Alexander De Luca, Nathan Malkin, and Serge Egelman. Keep on lockin’ in the free world: A multi-national comparisonof smartphone locking. In Proceedings of the 2016 CHI Conference on
Human Factors in Computing Systems, 2016.
[11] hashcat. hashcat advanced password recovery. https://hashcat.net/
hashcat/.
[12] Troy Hunt. Password reuse, credential stufﬁng and another billion
records in have i been pwned. https://www.troyhunt.com/passwordreuse-credential-stufﬁng-and-another-1-billion-records-in-have-i-beenpwned/.
[13] Renren Inc. Renrenwang. http://browse.renren.com/.
[14] Peter Kacherginsky. Pack (password analysis and cracking kit). https://github.com/iphelix/pack.
[15] Yue Li, Haining Wang, and Kun Sun. Email as a master key: Analyzing
account recovery in the wild. In INFOCOM, pages 1646–1654. IEEE,
2018.
[16] Zhigong Li, Weili Han, and Wenyuan Xu. A large-scale empiricalanalysis of chinese web passwords. In Proceedings of the 23rd USENIX
Security Symposium, pages 559–574, 2014.
[17] Jerry Ma, Weining Yang, Min Luo, and Ninghui Li. A study ofprobabilistic password models. In IEEE Symposium on Security andPrivacy, pages 689–704. IEEE Computer Society, 2014.
[18] William Melicher, Blase Ur, Sean M. Segreti, Saranga Komanduri,
Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. Fast, lean, andaccurate: Modeling password guessability using neural networks. In
Proceedings of the 25th USENIX Conference on Security Symposium,
SEC’16, pages 175–191. USENIX Association, 2016.
[19] Arvind Narayanan and Vitaly Shmatikov. Fast dictionary attacks on
passwords using time-space tradeoff. In Proceedings of the 12th ACM
Conference on Computer and Communications Security, CCS ’05, pages
364–372. ACM, 2005.
[20] Sarah Pearman, Jeremy Thomas, Pardis Emami Naeini, Hana Habib,
Lujo Bauer, Nicolas Christin, Lorrie Faith Cranor, Serge Egelman, andAlain Forget. Let’s go in for a closer look: Observing passwords in theirnatural habitat. In Proceedings of the 2017 ACM SIGSAC Conference
on Computer and Communications Security, CCS ’17, pages 295–310.
ACM, 2017.
[21] Shannon Riley. Password security: What users know and what they
actually do. In Usability News, Volume 8, Issue 1, 2006.
[22] Jatinderkumar R. Saini. Analysis of minimum and maximum characterbounds of password lengths of globally ranked websites. International
Journal of Advanced Networking Applications, 2014.
[23] Toshinori Sato. mecab-ipadic-neologd : Neologism dictionary formecab. https://github.com/neologd/mecab-ipadic-neologd/blob/master/
README.ja.md.
[24] Yukiko Sawaya, Mahmood Sharif, Nicolas Christin, Ayumu Kubota,
Akihiro Nakarai, and Akira Yamada. Self-conﬁdence trumps knowledge:
A cross-cultural study of security behavior. In Proceedings of the 2017
CHI Conference on Human Factors in Computing Systems, 2017.
[25] skullsecurity. Facebook lists, 2010. https://wiki.skullsecurity.org/index.
php?title=Passwords.
[26] Kurt Thomas, Frank Li, Ali Zand, Jacob Barrett, Juri Ranieri, Luca
Invernizzi, Yarik Markov, Oxana Comanescu, Vijay Eranti, Angelika
Moscicki, Daniel Margolis, Vern Paxson, and Elie Bursztein. Data
Breaches, Phishing, or Malware?: Understanding the Risks of Stolen
Credentials. In Proceedings of the 2017 ACM SIGSAC Conference on
Computer and Communications Security, CCS 2017, pages 1421–1434,
2017.
[27] Blase Ur, Fumiko Noma, Jonathan Bees, Sean M. Segreti, Richard Shay,
Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. “I Added ’!’ at
the End to Make It Secure”: Observing password creation in the lab.
In Eleventh Symposium On Usable Privacy and Security, SOUPS 2015,
pages 123–140, 2015.
[28] Rick Wash, Emilee Rader, Ruthie Berman, and Zac Wellmer. Understanding password choices: How frequently entered passwords are reused across websites. In Twelfth Symposium on Usable Privacy andSecurity , SOUPS 2016, pages 175–188. USENIX Association, 2016.
[29] Matt Weir, Sudhir Aggarwal, Breno de Medeiros, and Bill Glodek. Password cracking using probabilistic context-free grammars. In Proceedingsof the 30th IEEE Symposium on Security and Privacy S&P 2009, pages
391–405, 2009.
[30] Jianping Zeng, Jiangjiao Duan, and Chengrong Wu. Empirical study
on lexical sentiment in passwords from chinese websites. Computers &Security, 80, 2019.

21-50
51-100• 10137. How many distinct passwords do you have?
• 1
• 2-5
• 6-10• 11-20• 21-50• 51-100• 10138. How do you manage your passwords?
• I remember all passwords.
• I remember some of my passwords.
• I write down the passwords in my notebook or diary.
• I recorded my passwords in my PC or smartphone.
• I save my passwords in my browser.
• I use a password management software.
• other:[user’s input]
39. Please tell us your opinion about password management
software and give your reasons.
• I’m using one.
• I used to use one.
• I want to try.
• I won’t use it.
• I don’t know about it.
• other:[user’s input]
Reasons:[user’s input]
40. If you are using a password management software, pleaseanswer the following questions.
••

What is the name of the software?
Why did you choose it among a lot of password management softwares?
• What inspired you to use it?
••

R EFERENCES[1] 7k7k. 7k7k.com. http://www.7k7k.com/.
[2] Alexa. Website Trafﬁc, Statistics, and Analytics. https://www.alexa.com/
siteinfo.
[3] Mashael AlSabah, Gabriele Oligeri, and Ryan Riley. Your culture isin your password: An analysis of a demographically-diverse password
dataset. Computers & Security, 77:427–441, 2018.
[4] Burton H. Bloom. Space/time trade-offs in hash coding with allowableerrors. Commun. ACM, 13(7):422–426, 1970.
[5] Joseph Bonneau. The science of guessing: Analyzing an anonymized
corpus of 70 million passwords. In IEEE Symposium on Security andPrivacy, SP 2012, 21-23 May 2012, San Francisco, California, USA,pages 538–552, 2012.
[6] Joseph Bonneau and Sören Preibusch. The password thicket: Technicaland market failures in human authentication on the web. In WEIS, 2010.
[7] Francis Chang, Kang Li, and Wu-chang Feng. Approximate caches forpacket classiﬁcation. In INFOCOM, pages 2196–2207. IEEE, 2004.
[8] Anupam Das, Joseph Bonneau, Matthew Caesar, Nikita Borisov, and
XiaoFeng Wang. The tangled web of password reuse. In Proceedingsof the 21st Annual Network and Distributed System Security Symposium,
NDSS, 2014.
[9] Ameya Hanamsagar, Simon S. Woo, Chris Kanich, and Jelena Mirkovic.
Leveraging semantic transformation to investigate password habits andtheir causes. In Proceedings of the 2018 CHI Conference on Human
Factors in Computing Systems, CHI ’18, pages 570:1–570:12. ACM,2018.

171