Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone for a paid list though at http://dazzlepod.com/uniqpass/ but I am looking for something hopefully free!

  • 1
    Big lists can be a very good thing - it does depend on what you are trying to do. If testing in an environment with strong password complexity and length requirements, brute force and rainbow tables will not be useful options, so while you may have the most common passwords at the top of a list it may still be worthwhile to use a full list if you really want to crack them.
    – Rory Alsop
    Dec 8 '11 at 9:24

As the old adage says, "it's not the size of your word list that matters, it's how you use it." And which you use. I will provide you with some tips.

For password lists and non-password word lists relevant to my suggestions, see SkullSecurity, KoreLogic, and Openwall. The leaks mentioned are all from SkullSecurity. Or you can hunt down leaks and use them as a basis, over time developing good lists. See the twitter feeds of pastebinleaks and keep an eye on the news and hunt down leaks that are announced, especially when in plaintext. Even if some of the leaks are pure hashes and you need to crack them, it will still give you an idea of what is being used in the wild and help you assess the value of your password lists.

On to the advice.

  • Chose a word list relevant to your target's user base
    • Password leaks similar to your target (e.g. Faithwriters, Hak5, Ultimate Strip Club List)
    • Relevant topics (Sport teams and terminology, slang, city/town names)
    • Relevant languages (e.g. Älypää leak, foreign dictionaries, foreign Wikipedia)
  • Generate your own!
    • Crawl target's website
    • Strip and then use mangling rules on passwords already cracked
    • Look for trends in passwords already cracked and find a source (or generate one) that is categorically similar
  • Mangle generic lists
    • Look at JtR's default mangling rules and KoreLogic's published ones for inspiration
    • Name lists. first initial last name, first name last initial, first name, last name
    • Write mangling rules that fit patterns you see in passwords already cracked
    • Lists of random ordinary stuff (e.g. phone numbers)
  • Don't use lists at all
    • Markov chains (see JtR Jumbo)
    • JtR default incremental modes
    • Other probability stuff
    • Go through all digit combinations between 1 digit and as high as you can handle
    • Use Rainbow tables if unsalted passwords are in use
  • Be lazy and use generalized leaks like RockYou
  • Think about password policy
    • Learn what the password policy is through analysis on cracked passwords
  • Realize patterns may just be your imagination or created by your tactics
  • Think about what keyspaces and tactics you haven't tried

In summary:

  • Password lists aren't everything
  • Learn to write good mangling rules
  • Analyze what you've cracked
  • Use scripting to generate common patterns on-the-fly
  • Create your own word lists
  • Chose relevant lists

The best site I found for this is SkullSecurity. It does have huge collection of passwords. Some were leaked during real attacks, so they are pretty recent.

  • 1
    Nice collection and categorized as to source and use.
    – schroeder
    Dec 8 '11 at 16:02
  • Rockyou and the Wikipedia ones will get A LOT of basic passwords. Then you start combining them, permuting them, running through all the usual rules (JtR and Hashcat both have wonderful sets stock), and you should have >50% cracked at that point.
    – Marcin
    Jun 18 '12 at 19:06

Also check out http://g0tmi1k.blogspot.com/2011/06/dictionaries-wordlists.html


I just found a good looking source:


just use "fgrep" for various passwords in the dictionary to test the quality. The top passwords are at the beginning of it (for slow hashes I assume).

Looks like many things got into this wordlist that has 3 001 834 125 lines, 40 GBytes. Compressed: 6.5 Gbytes.


I came across this page http://cyberwarzone.com/cyberwarfare/password-cracking-mega-collection-password-cracking-word-lists recently. There's links to a large number of lists there, so hopefully some useful ones.



Massive Password/Dictionary pack = 52.9 GB extracted.

  • The link is dead.
    – toster-cx
    May 6 '16 at 17:19

220 Gb no duplicates, only words >=8 chars. http://biggestpasswordlist.com/

  • 4
    It looks like you're affiliated with this resource. Could you edit your post to make that clear? See How to not be a spammer for more information.
    – Undo
    Sep 4 '17 at 14:40
  • 1
    To all those voting, this answer is not different from the rest of the other answers. I closed the question, but we can't justify deleting this answer without deleting the others.
    – schroeder
    Sep 5 '17 at 10:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.