RockYou data breach: the leak that shaped password cracking
2 min read · Updated October 15, 2026
In December 2009 the social app company RockYou suffered a breach that exposed roughly 32 million passwords stored in plain text. The list became a standard wordlist used to test and crack passwords. The lesson: never reuse passwords, and avoid common ones that appear in such lists.
What happened
Attackers exploited a flaw to access RockYou’s user database, which stored passwords without encryption. The data spread widely and has been used ever since by both security researchers and criminals.
Why it is famous
It gave the world a large, real-world sample of how people choose passwords. Simple choices such as names, ‘123456’ and ‘password’ dominated, and cracking tools now try them first.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
What it teaches us
- ✓Common passwords fall in seconds.
- ✓Plain-text storage turns a breach into an instant disaster.
- ✓Reusing a password means someone else’s mistake becomes yours.
What to do
- ✓Use a password manager to generate long random passwords.
- ✓Never reuse passwords between accounts.
- ✓Turn on two-factor authentication.
- ✓Check your email address for known breaches.
Frequently asked questions
Is the RockYou list still used?+
Yes. It is a common starting wordlist in password-cracking and testing tools.
What is RockYou2021?+
A 2021 compilation of billions of leaked entries, largely recycled from earlier data. It reinforced the importance of unique passwords.
Is my password likely on such lists?+
If it is short, common or reused, assume so and replace it.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.