How Bad Is Your Birthday as a Password?

2024-12-05

I taught a class tonight that covered password security, and got the idea to check my date of birth against the https://haveibeenpwned.com/ database of documented password leaks from around the internet to demonstrate how bad a date is as a password. Seeing thousands of hits for my birthday, I got the idea of seeing if it was better or worse a decade earlier, then a decade later. I soon realized my birthdate was in the sweet spot. Being born on a double-digit month and a double-digit day makes my specific date more probable than most other dates, but I checked and it turns out my birth year, 1986, is the worst year on record for this. Presumably the peak combination of being on the internet frequently and for a long time?

My exact date of birth ranks 114 out of 36526 dates in the last 100 years, or the 99.7th percentile!

If you normalize popularity by year and find the true outliers, you probably end up with a slight bias against the mm-dd-yyyy parts of the world (which we deserve, because it’s bad!), but given how connected we are, it should balance out. It’s the overall headcount that I think must drive it, as all-time popular dates seem to have a bias towards Asia. It’s hard to say though — roughly 2/3 of the top 100 don’t seem to be noteworthy dates, perhaps just bubbling up due to noise in unpopular years. Of the remaining, we have:

• 4 Births: Elvis Presley, Che Guevara, Gandhi Jayanti, and Adolf Hitler
• 8 Holidays: 2x Taiwan National Day (Double Ten Day), 1x Chinese New Year, 1x Christmas Day, 3x New Year’s Day, and 1x New Year’s Eve
• 4 Political: Anschluss of Austria by Nazi Germany, Founding of the People’s Liberation Army (China), Founding of the People’s Republic of China, and the Xi’an Incident (Chinese political crisis)
• 3 Cultural: Opening of 2008 Beijing Olympics, Closing of 2022 Beijing Olympics, release of the movie Oppenheimer
• 2 Violence: 1998 US Embassy bombings, Delhi gang rape
• 11 War: Attack on Pearl Harbor, US declaration of war on Japan, Chinese intervention in Korean War, D-Day, Germany invades Poland, Marco Polo Bridge Incident (start of second Sino-Japanese war), Mukden Incident (start of Japanese invasion of Manchuria), start of the Nanking massacre, Victory Day in Europe, Victory Day over Japan

Well, I thought it was interesting!

Follow-up: the full analysis

The next day I pulled the entire dataset and charted every date in the last 100 years (r/dataisbeautiful, 263 points). Tools: haveibeenpwned-downloader for the data, C# to hash dates to SHA1 and search, Excel for exploration and charts, ChatGPT o1 to flag dates plausibly popular because of world events.

Answers to the obvious questions: in absolute terms the most common date is 1987-02-12, an unremarkable day in a dominant period. The most popular event-driven date was the 2008 Beijing Olympics opening ceremony, 2008-08-08 — 8 is lucky in China and the date was chosen on purpose — placing 4th overall. The only dates top-100 both absolutely and relative to their year: that ceremony, the 1998 US Embassy bombings (1998-08-07), and the founding of the PRC (1949-10-01).