Passwords Reused Across 26 Sites, Study Finds

Carnegie Mellon researchers tracked 154 people for an average of 147 days and found each logged into 26 web domains with fewer than 10 unique passwords. About 60 percent were reused outright or built from existing strings, and 85 percent of financial-site passwords appeared elsewhere. NIST's 2025 guidelines now bar forced character mixing and periodic resets.