[calvins]

I wish they would include how many times each password was used. Those top 25 representing 50,000 out of a million passwords means something very different than if they represent just 1,000 out of a million.

Comparing the proportion of the million passwords that are accounted for by the top 25 (and top 100, top 1000, etc.) year to year also gives a much better measure of whether public behavior is improving than just seeing if the top 25 are obviously poor passwords.