> Password List Creation & Usage Guide (Ethical)
Ethics & Permission: For educational, internal, and authorized audits only. No unauthorized access. This guide focuses on safe crafting and policy testing, not exploitation.
⚠️ Use Responsibly: Proceed only if you understand this content is for authorized policy testing and awareness. Do not target real accounts or third parties.
> 🧠 Why Custom Wordlists Matter
Everyone downloads common lists like rockyou.txt. To improve defensive testing and awareness, build lists that reflect your own policy risks (seasonal patterns, brand terms, keyboard walks) and use them to harden account policies.
> 📦 Collect Seed Sources (Safe)
- Public lists (e.g., SecLists)
- System packs at
/usr/share/wordlists - Internal policy terms to guard against (company name variants, sports seasons, years)
Privacy tip: Never harvest real user data for lists. Use synthetic/representative words to model risky patterns.
> 🧪 Combine & Clean
cat rockyou.txt probable.txt other.txt > combined.txt
sort -u combined.txt > base_clean.txt # dedupeDeduplication reduces size and speeds up policy checks. Keep originals read-only.
> 🔧 Safe Mutations (Policy-Oriented)
Create simple, representative mutations to test whether your password policy rejects weak patterns. Keep these offline and lab-only.
# append common suffixes
awk '{print; print $0"!"; print $0"1"; print $0"123"}' base_clean.txt > base_mut.txt
# add uppercase variants
awk '{print; print toupper($0)}' base_clean.txt > base_case.txt
# merge and dedupe
cat base_mut.txt base_case.txt | sort -u > policy_test_candidates.txt> 🛡️ Validate Against Your Policy (No Attacks)
Instead of attacking accounts, validate candidate words against your password policy and strength estimator in a controlled environment.
- Check minimum length, character classes, and banned words list.
- Use local strength estimators (e.g., library-based entropy/zxcvbn-style checks) on sample candidates.
- Measure how many candidates would be rejected — aim for high rejection of weak patterns.
> 📊 Measure & Improve
- Coverage: Do your banned terms include brand words, years, and keyboard walks?
- Friction: Are users forced into passphrases (14–20 chars) instead of short patterns?
- Rotation & MFA: Favor strong initial setup + MFA over frequent forced rotations.
> ❓ FAQ
Can I use these lists to break into systems?
No. This guide is exclusively for authorized policy testing and awareness. Unauthorized access attempts are illegal and unethical.
What about cracking tools?
Out of scope here. Focus on measuring your policy and training users to avoid predictable patterns. Combine MFA with strong, unique passphrases.