In the past year, over 100 million passwords, and password hashes have been leaked by attackers. Most of these leaks takes place on sites such as pastebin/twitter and mediashare. What can we lean about password creation from this new set of data? A set of data that did not publicly exist 2-3 years ago. What did we find out? Your passwords suck. And web-sites have no idea how to fix it.