I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?

I've found some through Google, but I’m interested in hearing about where you get your dictionaries from.


9 Answers 9


Nice list collected by Ron Bowes you can find here:

Other list is from InsidePro:


An important one that hasn't been added to the list is the crackstation wordlist

The list contains every wordlist, dictionary, and password database leak that I could find on the internet (and I spent a LOT of time looking). It also contains every word in the Wikipedia databases (pages-articles, retrieved 2010, all languages) as well as lots of books from Project Gutenberg. It also includes the passwords from some low-profile database breaches that were being sold in the underground years ago.

Best thing is, its free, although you can (and should!) make a donation!


Some additional ones to add to those already suggested

  • 1
    Either the Oxford one is now broken or not publicly available. Oct 23, 2017 at 17:21

Try the CrackLib dictionaries: https://web.archive.org/web/20161225012801/http://linux.maruhn.com/sec/cracklib-dicts.html


I tested the likelihood of collisions of different hashing functions. To help test, I tried hashing

  • all 216,553 words in the English language. Start with those 17.7 bits.

  • then the list of all 2,165,530 English words with one digit after it. (21.0 bits)

  • then the list of all 21,655,300 English words with two digits after it. (24.4 bits)

  • then the list of all 524,058,260 English words with a possible capital as the first letter, and followed by zero, one, or two digits. (29.0 bits).

With one list of English words you'll cover nearly everyone's password.

Note: XKCD is always relevant

  • 1
    When cracking, these permutations (adding a digit, capitalizing) are usually done with "rules". For example, Hashcat takes a given dictionary and applies a user-defined set of rules (hashcat.net/wiki/doku.php?id=rule_based_attack). This allows a trade-off between disk space and processor resources.
    – mcgyver5
    Mar 10, 2014 at 12:19
  • 2
    Your second link (all words in the English language) gives a 404 now, but it has been archived by the WayBack machine.
    – ComFreek
    Jun 7, 2014 at 9:18
  • A list of all english words is an acceptable starting point, but not a particularly good one. For example, the very simple and very popular passwords of "123456", "asdasd" and "letmein" would not be found by an approach used in this post; you want to start with specific lists of common passwords instead of an english dictionary.
    – Peteris
    Jan 18, 2017 at 11:07

Another good source is here http://blog.g0tmi1k.com/2011/06/dictionaries-wordlists/


[Analysis] Dictionaries & Wordlists
In general, it's said that using a GOOD 'dictionary' or 'wordlist' (as far as I know, they're the same!) is 'key'. But what makes them GOOD? Most people will say 'the bigger, the better'; however, this isn't always the case... (for the record this isn't my opinion on the matter - more on this later).


You'll find lots of words in lots of languages on the download page for the English Wiktionary. enwiktionary-latest-all-titles-in-ns0.gz contains just page titles, including phrases - it might have underscores instead of spaces though. (we have English definitions of words from many languages).

And of course there's also WordNet.

(sorry but as a newbie I can only include one link)


All the posts so far have great information, but remember you can always generate word lists yourself with a utility like crunch.

If you have an idea of what the password parameters are (for example, has to be 8-10 chars with only letters and numbers, no symbols), you can pipe crunch to most bruteforce programs with the tailored parameters.


This is one that I have found useful over the years:


It includes popular passwords, fuzzing based on attack type and popular user names.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .