In known wordlists like crackstation.lst there are random emails in the list. Why are they there?

3 Answers 3


There are a few reasons (and often all three are in play):

Larger wordlists are often dirty. Unless the list is specifically filtered for likely noise / "junk" - such as the Crackstation "human" variant - then a variety of other plaintexts often find their way into lists, simply because people are shoveling a large variety of data into their wordlists.

Larger hashlists are often dirty. Uncracked hashes that are submitted via a public interface or API are often taken from a variety of sources, including hashes of email addresses that are used - naively, or deliberately - as unique, normalized, semi-obfuscated tokens for a given platform. For example, Gravatar deliberately uses hashes of email addresses in URLs. An attacker who knows this will then try all sorts of common usernames and email domains, and crack many of them. This makes them end up in wordlists.

Some people literally use email addresses as their passwords. This is because they're easy to remember, and users (naively) think that someone might not guess that they're using their alternate email, or even someone else's email, as their password.


Presumably it's just people using their email address as their password..

  • Yup. Wordlists are sourced from real-world password dumps so this is the most likely
    – belkarx
    Apr 26, 2022 at 23:09

There are two main reasons:

1. People using them for privacy

Some people are privacy oriented, and they will create random looking email addresses for different services. This way it's not easy to link all of its personas based on the email address.

2. They are fake and used to track leakage

They are called Copyright Traps. They are most common on maps and dictionaries, so anyone copying data from them would copy the fake streets or words too, and the owner of the data would know for sure who copied its information.

On leaks, sometimes the leaker will add fake emails that aren't expected to be found anywhere, and if anyone buys the data and leaks it later, the original "owner" of the data can know for sure who leaked the list by searching the traps on the leaked data.

  • 1
    I mean only wordlist (Like rockyou.txt), not lists like user:pass Apr 26, 2022 at 19:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .