Leakpeek
Teaching · Awareness exercise
Leakpeek shows what the most common leaked passwords actually look like. Type the start of an invented password and the page finishes it for you, from the 100,000 most common entries in a public breach list. It makes weak password shapes visible without checking anyone's real password.
See common leaked-password shapes.
Leakpeek is an awareness-session artefact. Type a made-up start and watch the list finish it for you — that reflex is exactly the one attackers count on.
Read this first
Do not type a real password. Type something invented. This shows you what common leaked passwords look like; it cannot tell you whether yours is safe.
Nothing you type leaves your browser. The whole list is already loaded into this page, so every match is worked out on your own device — no request is made, and nothing is recorded.
Type at least 3 made-up characters to see what commonly follows them.
Where the list comes from — RockYou (2009 breach), distributed by the SecLists project. The published list holds 14,344,391 passwords; this page carries the top 100,000 of them, in the frequency order that list itself uses. Source list.
The ranking here matches the Go loader kept alongside this site, which is derived from cybermonkey/leakpeek under the AGPL-3.0 — see backend-leakpeek/ATTRIBUTION.md for the licence reconciliation.
Questions about the list, or want an entry taken out? Email hello@cybermonkey.net.au.
The included items, listed plainly. No asterisks, no fine print.
- 01Ghost-text autocomplete over the 100,000 most common entries from the 2009 RockYou breach list, published by the SecLists project
- 02Narrowed from a corpus of 14,344,391 passwords using the same frequency weighting the workshop loader applies, so the page and a guided session rank alike
- 03No public hosted lookup: the list ships inside the page, so every match is worked out on your own device and no request leaves your browser
And what it is not.
- A password checker. Leakpeek answers "what do common leaked passwords look like?", not "is my password safe?". Never type your real password into it.
- A breach lookup. We do not tell you whether a specific account has been exposed — that is what Have I Been Pwned is for, and we send people there.
- A public password lookup. There is no Leakpeek server behind this page: the list is part of the page itself, so what you type is never transmitted, stored, or matched against an account.
Curious about Leakpeek?
Drop us a line. We will set up a friendly, no-pressure conversation and walk you through whether this is a fit for your situation.