Is it unlawful in the United States to sell passwords of other people?

If the passwords were obtained through malicious attacks on an organization's database, does that affect the legality?

  • 1
    Do you mean "sell with permission of the account owner", or "sell without permission of the account owner"?
    – user6726
    Commented Aug 31, 2016 at 22:52
  • @Dawn Why not? That's also a perfectly good question too. Passwords may be considered the property of the system owner and not the account holder. Commented Sep 1, 2016 at 17:08
  • 1
    @DavidSchwartz Just didn't think that was the angle that the asker was going for.
    – user3851
    Commented Sep 1, 2016 at 17:22
  • 1
    The system owner should not even know what the password is.
    – gnasher729
    Commented Sep 2, 2016 at 14:47
  • 1
    He should securely hash the passwords but there's no way to enforce that. Also a compromise could occur while a password is en route to being secured. Commented Sep 2, 2016 at 14:49

1 Answer 1


Assuming here that this is without the permission of the current account-holder. As discussed above, from a tort law angle there would be some confusion as to who owned the password in the first place. However, under US Federal Criminal Law, such action is explicitly criminalized: Title 18 USC§ 1030(a)(6)(A) [Computer Fraud and Abuse Act] provides that:

(6) [Whoever] knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if—

(A) such trafficking affects interstate or foreign commerce; or

(B) such computer is used by or for the Government of the United States;

... shall be punished as provided in subsection (c) of this section.

Subsection C then sets a punishment for such a crime at a fine and/or imprisonment for up to 1 year. Repeat offenses (this applies to any past offense under any part of the CFAA, not just password trafficking) have a maximum sentence of 10 years.

  • Suppose I steal somebody's password to access somebody else's account on a computer/server that I already have access to through an account of my own, is that illegal? By that definition, it seems it would not be, since I would already be authorized to access that computer/server.
    – jvriesem
    Commented Apr 19, 2020 at 16:50
  • 1
    @jvriesem you should look at the text of the statute. It explicitly covers "exceeding authorized access". Using somebody else's account without their permission would definitely be "exceeding authorized access". Commented Apr 19, 2020 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .