Build smarter wordlists for security and play.
A 40GB wordlist dump feels impressive until you watch it lose to a hand-pruned 10,000-word list on the same hardware. Here's the argument for putting your wordlist on a diet — with benchmarks to back it up.
Vanity license plates are a public, self-selected corpus of how Americans abbreviate, pun, and play with language — and almost nobody in security is mining them. Here's how to turn spotted-at-the-red-light photos and state DMV databases into state-specific wordlists that crack like nothing generic ever could.
Keyboard-walk attacks assume everyone types on QWERTY — but Dvorak and Colemak users broke that assumption decades ago. We ran a mini-study to see whether layout-aware pattern lists actually crack more passwords, and the results suggest your ruleset might be trained on the wrong keyboard.
Long before passwords, Americans were encoding words as numbers every time they dialed 1-800-FLOWERS. That keypad mapping — letters to digits — still shows up in how people build PINs and passwords today. Here's how to turn that habit into a smarter wordlist.
The most predictable password material in America isn't in any data breach — it's on a family tree site, free to browse. Here's how a red teamer reconstructs a target's wordlist from Ancestry.com and a few Facebook birthday posts, and why you should try it on your own relatives (with permission).
Vanity plate rules, state mottos, and tourism slogans are public, quirky, and weirdly personal — which makes them perfect raw material for geographically-tuned wordlists. Here's how to harvest and normalize local government lexicon that generic dictionaries will never catch.
Autocorrect engines learned English from billions of real keystrokes, which means they already know which words people actually type — and type often. Here's what that means for anyone building frequency-weighted wordlists for cracking, puzzles, or research.
Words like 'cleave,' 'dust,' and 'sanction' carry two contradictory meanings, and most wordlist generators have no idea. Here's why Janus words skew your frequency counts, throw off entropy estimates, and how to build a generator smart enough to handle them.
Every year the Social Security Administration publishes a dry dataset of American baby names, and every year password researchers and puzzle builders pounce on it. Here's why a bureaucratic birth-records report became one of the most downloaded wordlist sources on the internet — and how to use it responsibly.
Taylor Swift lyrics, Marvel villains, and the top baby names of 2024 don't just dominate headlines — they dominate password dumps and puzzle lexicons too. Here's how to mine pop culture for sharper wordlists, and where the ethical lines sit.
Competitive spellers don't memorize the dictionary — they internalize which letters and letter-pairs show up where. That same statistical instinct can make your password audit wordlists dramatically smarter. We talked to hobbyist bee champs and built a frequency-weighted list to prove it.
Scrabble players have rioted over dictionary updates for decades — words added, words banned, tournaments in chaos. Turns out, the drama looks a lot like what happens when security teams argue over what belongs in a wordlist.
Password managers are great until they aren't. Here's how rolling physical dice against a well-built wordlist produces passphrases that are mathematically bulletproof — and how to build your own custom Diceware list with our generator.
Passwords leak geography. From Broncos fandom in Denver to street names in Brooklyn, regional habits shape credential patterns in ways generic wordlists miss. Here's how to build a targeted list from census data, sports rosters, and place-name databases — and why pentesters auditing local businesses should bother.
Scrabble tournament lists, spelling bee archives, and Project Gutenberg texts have a second life most players never imagine: raw material for password cracking dictionaries. We trace that pipeline and the legal gray zone that comes with it.
Turns out the person building Thursday's toughest crossword and the pentester guessing your Wi-Fi password are doing the same job with the same tools. Here's how frequency analysis, letter patterns, and smart wordlist curation serve both puzzle nerds and security testers.
Throwing a beefy GPU at a bad wordlist is like bringing a monster truck to a spelling bee. Here's how smarter dictionary attacks actually work, how to build a targeted list for testing your own passwords, and where the legal lines sit.