Every year, thousands of passwords are leaked to the internet (most often via a post to pastebin). For the individuals carrying out these embarrassing attacks, its just about the lulz, or proving a point. For each organization whose passwords are leaked, and for their users, this is a travesty. For us, though, its a valuable opportunity to gain insight into passwords as the primary unit of authentication. We all use them, but what do we really know about them? This treasure trove of statistically significant data is available, and its only fair to the victims of these crimes that we do something good with this data. Were building an automated system to comb the web for leaked passwords and warehouse them. Once stored in a centralized database, these passwords are the subject of statistical inquiries: Whats the most common password? Whats the breakdown of character classes in each password? How many of them are present in widely available rainbow tables? How long would it take to perform an online brute force attack on the weakest 10% of all passwords? Answers to these questions and more are well within our reach when we collect and analyze this publicly available data. Beyond being able to do analysis, we can make a compact rainbow table style database of hashes for all passwords weve seen. Our database includes all the common hash types (MD5, SHA1, SHA256, NTLM, MySQL, and others). We call this combination of multiple hash types into a single table double rainbow tables for obvious reasons. A public database of known in-use passwords pressures users to use more secure passwords for their own accounts, and devs to properly salt their hashes. We will discuss lessons learned building scrapers and an ingest framework for specific data in a disparate array of unstructured data sources, raw observations in data we have collected, and statistically significant conclusions from the data we have collected. We will also be releasing our source and aggregate data for further analysis.