Wordlists collection

This repository contains a curated collection of wordlists commonly used for password auditing, security research, discovery, enumeration, fuzzing, and penetration testing.

Many of the most effective password lists are derived from real-world credential breaches (commonly known as pwned passwords), such as the well-known rockyou.txt. Others are generated from honeypot captures, malware campaigns, public leaks, dictionary sources, keyboard patterns, and targeted datasets.

Note: Kali Linux ships with several password dictionaries by default. One of the most commonly used is available at:

/usr/share/wordlists/rockyou.txt.gz

Books

Wordlists derived from collections of book titles and literary works.

Wordlist	Entries
Greatest books of all time (lowercase)	15,326 lines
Greatest books of all time (original)	5,568 lines
Greatest books of all time (uppercase)	15,326 lines
Greatest books of all time (leet variations)	31,700 lines

Common Passwords

Frequently used passwords collected from public studies, breach analyses, and security research.

Wordlist	Entries
100k most used passwords (NCSC)	99,840 lines
10k most common passwords	10,000 lines
200 most used passwords (2020)	200 lines
200 most used passwords (2023)	200 lines
200 most used passwords (2024)	200 lines
200 most used passwords (2025)	200 lines
500 worst passwords	500 lines
Common passwords (Windows)	815 lines
Most popular letter-based passwords	47,603 lines
Probable v2 Top 12k	12,645 lines
PWDB Top 100k	100,000 lines
PWDB Top 10 million	10,000,000 lines
Top SSH passwords	22 lines
Xato 10 million passwords	5,189,454 lines

Cracked Hashes

Passwords recovered from publicly available cracked hash collections.

Wordlist	Entries
Milw0rm dictionary	84,198 lines

Discovery

Wordlists intended for content discovery, web enumeration, DNS reconnaissance, and fuzzing.

Wordlist	Entries
Backup files only	1,015 lines
Backup files with path	1,286 lines
Common	4,613 lines
Directory only one	1,993 lines
DNSMap domains	17,576 lines
Sensitive files (Unix)	16 lines
Sensitive files (Windows)	7 lines
Subdomains	114,532 lines

Honeypot Captures

Passwords collected from internet-facing honeypots and attack telemetry.

Wordlist	Entries
Multiple sources (Fabian Fingerle)	105,096 lines
Python Heralding (September 2019)	51,286 lines

Keyboard Walks

Passwords based on keyboard patterns and common typing habits.

Wordlist	Entries
Keyboard combinations	9,608 lines
Walk the line	279,616 lines

Leaked Databases

Passwords extracted from publicly disclosed breaches and leaked credential datasets.

Wordlist	Entries
000webhost	720,302 lines
Alleged Gmail passwords	3,132,006 lines
Ashley Madison	375,853 lines
Dark Web 2017	9,999 lines
Facebook phished	2,441 lines
Fortinet 2021 passwords	78,977 lines
Hak5	2,351 lines
Hotmail	8,930 lines
Lizard Squad	11,781 lines
MD5Decryptor UK	3,431,316 lines
Muslim Match	95,072 lines
Nmap	4,999 lines
NordVPN	1,437 lines
phpBB cleaned-up	184,364 lines
Porn (unknown source)	8,088 lines
RockYou	14,344,392 lines
Singles.org	12,233 lines
Tuscl	38,820 lines
YouPorn 2012	4,064 lines

Other

Miscellaneous and language-specific wordlists.

Wordlist	Entries
Italian wordlist (lowercase)	344,074 lines
Italian wordlist (mixed)	419 lines

Password Dictionaries

General-purpose dictionaries, dates, seasons, default credentials, and password permutations.

Wordlist	Entries
1337 Speak	1,134 lines
1900–2030 dates	48,664 lines
Conficker worm	181 lines
Darkc0de	1,471,056 lines
Days	6,240 lines
Default passwords	1,335 lines
Default passwords for services	1,243 lines
KoreLogic password list	1,152 lines
Months	13,431 lines
Password permutations	72 lines
Merriam-Webster SCRABBLE (4th Edition)	45,949 lines
SCRABBLE large	589,940 lines
SCRABBLE munged large	597,337 lines
Seasons	5,390 lines

WPA Passwords

Wordlists specifically tailored for WPA/WPA2 password auditing.

Wordlist	Entries
WPA over 200k	203,806 lines
WPA top 4.8k	4,800 lines
WPA top 447	447 lines

Software Generated

Wordlists distributed with or generated by popular password auditing tools.

Wordlist	Entries
BackTrack 4 passwords	1,652,903 lines
Cain & Abel	306,706 lines
John the Ripper	3,106 lines

Recommended Lists

For most use cases, the following wordlists provide the best balance between effectiveness and size:

Password Auditing

• rockyou.txt.bz2
• Pwdb_top-100000.txt
• 100k-most-used-passwords-NCSC.txt
• xato-net-10-million-passwords.txt
• darkc0de.txt

Web Discovery & Enumeration

• common.txt
• subdomains.txt
• dnsmap.txt
• backup_files_with_path.txt

WPA/WPA2 Auditing

• wpa-over200k.txt
• wpa-top4800.txt

Default Credentials

• default-passwords.txt
• default_passwords_for_services.txt

License

This project is licensed under the MIT Licence. See the LICENSE file for details.

Disclaimer

This repository is intended for educational and authorised security testing purposes only. I don't promote unauthorised access, malicious activity, or misuse of the resources provided, and I will not be responsible for any illegal activities.