RockYou, 2009: the 32 million plaintext passwords that became a wordlist

Thirty-two million accounts is a small breach by modern standards, and RockYou, a company that made quizzes and photo widgets for MySpace and Facebook, is not a name most people remember. It is nonetheless one of the most consequential breaches ever recorded, because of a single detail: the passwords were not hashed. They were stored exactly as typed. That file is still in daily use.

What happened

In December 2009, a researcher published details of a SQL injection vulnerability in a RockYou web application. SQL injection is the oldest widely exploited web flaw there is: user input is concatenated into a database query rather than passed as a parameter, so an attacker can end the intended query and append their own. It was thoroughly documented, thoroughly understood and thoroughly preventable long before 2009.

Someone used it to dump the user table, 32.6 million rows of email addresses and passwords, the passwords in plain text. The file went public within days.

What the file revealed

Until RockYou, the industry's knowledge of real password choice was inferred from cracked hashes, which is a biased sample, because cracking finds the weak ones first. RockYou was the first large, unbiased census. Imperva's analysis the following month is still quoted:

1. The most common password was 123456, chosen by roughly 290,000 accounts, followed by 12345, 123456789, password and iloveyou.
2. Around 30% of passwords were six characters or fewer, and about 60% used a limited character set.
3. Roughly one account in five used a password from a set of just 5,000 common choices, meaning a trivially small dictionary would open a fifth of the site.

Those proportions have barely moved since. Every subsequent large breach that has been analysed produces a similar distribution, which is the uncomfortable finding at the centre of this case: password policies got stricter, complexity rules proliferated, and human behaviour stayed put.

How a breach became a tool

The deduplicated list of unique passwords from the dump, about 14 million entries, became rockyou.txt. It ships with Kali Linux. It is the default wordlist for Hashcat and John the Ripper tutorials, the first thing tried in almost every password-audit engagement, and the baseline against which new cracking techniques are measured.

This is a genuinely strange legacy. A company's worst day became free infrastructure for the entire security profession, and the reason it works so well is not technical sophistication, it is that the file is a record of authentic human choice, taken from people who had no idea anyone would ever read it. Synthetic password lists are guesses about what people pick. RockYou is evidence.

The name has since been borrowed by unrelated aggregate files, compilations circulated in 2021 and 2024 under names like "RockYou2021", which are not RockYou data at all but enormous merged collections of every password ever leaked. The borrowing is a compliment to the original's reputation and a reliable source of confusion.

The regulatory tail

In March 2012 the US Federal Trade Commission settled with RockYou over two distinct failures. The first was the security one: the company had told users their information was protected while storing it in plain text behind an injectable application. The second was a children's privacy violation, RockYou had knowingly collected information from roughly 179,000 children in breach of COPPA, and paid a $250,000 civil penalty for it.

The settlement is an early example of a regulator treating a security promise as a marketing claim. RockYou was not punished simply for being breached; it was punished for the gap between what its privacy page said and what its database looked like.

What it changed

Plaintext storage became indefensible. It was already bad practice in 2009. After RockYou, it was the kind of thing that appeared in regulatory findings and court filings, and there was a concrete, citable example of exactly what happens when the file escapes.

Password strength meters got a data source. Modern strength estimators, the ones that tell you a password is weak because it is common rather than because it lacks a capital letter, are built on frequency data, and RockYou was the first large real-world frequency table available. The shift from "does it have a symbol?" to "how many people have already chosen this?" starts here.

Breached-password checking became a product. The idea that a site should refuse a password that appears in a known breach list, rather than demanding another special character, follows directly from having lists like this one. It is now formal guidance in the US National Institute of Standards and Technology's digital identity standards.

What to take from it