Investigating the Relationship Between Password Distribution and Zipf’s Law

In this paper we want to look at the distribution with which passwords are chosen. Zipf’s Law is commonly observed in lists of chosen words. Using password lists from four different on-line sources, we will investigate if Zipf’s law is a good candidate for describing the frequency with which passwords are chosen. We look at a number of standard statistics, used to measure the security of password distributions, and see if modeling the data using Zipf’s Law produces good estimates of these statistics. Finally, we assess how similar the common passwords in different instances of these password lists are by using guessing as a metric.