What Are Wordlists?
A wordlist (or password dictionary) is a plain-text file containing a collection of passwords — one per line. These lists are used by security tools to perform dictionary attacks, where each entry is tested as a potential password against a captured hash or login form.
Most wordlists are derived from real-world data breaches — when a company gets hacked, the stolen credentials eventually surface online. The most famous example is RockYou, a list of 14.3 million passwords leaked from the RockYou.com breach in 2009. Despite being over 15 years old, it remains the go-to starting point because people continue to use weak, predictable passwords. Wordlists are the fuel for tools like hashcat and WPA2 cracking with aircrack-ng — see the full Kali Linux toolkit for where they fit.
In 2024, a compilation called RockYou2024 appeared online containing nearly 10 billion entries aggregated from multiple breaches — though working with lists this large requires significant hardware and filtering.
Kali Linux Built-In Wordlists
Kali Linux ships with several wordlists pre-installed at /usr/share/wordlists/. You can see everything available by running:
The most important one is rockyou.txt.gz. It ships compressed to save disk space on live-boot environments. You need to decompress it before use:
rockyou.txt.gz (the compressed file). This won't work — you must decompress it first with gunzip.
The Best Wordlists to Download
Here's a comparison of the most popular wordlists and where to get them:
| Wordlist | Size | Best For | Source |
|---|---|---|---|
| Kennyvn WPA2 Collection | Varies | WiFi WPA2 cracking | GitHub |
| RockYou | 14.3M passwords | General password cracking, WPA2 | Pre-installed on Kali |
| SecLists | Multiple lists | Web app testing, fuzzing, passwords | apt install seclists |
| CrackStation | 1.5B passwords | Hash cracking (large scale) | crackstation.net |
| Probable Wordlists | Sorted by frequency | Common passwords, ISP defaults | GitHub |
| Weakpass | Multi-GB | Comprehensive breach data | weakpass.com |
Installing SecLists
SecLists is the most comprehensive wordlist collection — categorized lists for passwords, usernames, URLs, fuzzing payloads, web shells, and more. It's maintained by Daniel Miessler and is the standard in the industry.
Downloading the Kennyvn WPA2 Collection
I've curated a collection of wordlists specifically compiled for WPA2 WiFi cracking. They're sorted alphabetically and split to fit GitHub's upload limits:
How To Use Wordlists with Popular Tools
How to use wordlists with the three most common password cracking tools on Kali Linux:
aircrack-ng (WPA2 WiFi cracking)
Before aircrack-ng can do anything, you need a captured WPA2 handshake — and capturing one requires a wireless card that supports monitor mode and packet injection. Not every adapter does. If yours doesn't, see my guide to the best wireless adapters for Kali Linux. For the complete capture-to-crack process, follow the full WPA2 cracking walkthrough with aircrack-ng and hashcat.
hashcat (GPU-accelerated hash cracking)
-r best64.rule). Rules automatically generate variations like password → Password1!, p@ssword, password2026, etc. This is far more effective than brute-forcing with a raw list, and it keeps GPU memory usage manageable.
hydra (online brute-force)
6VlgB@.|dI11@o5JG3LH! won't appear in any wordlist. In those cases, you'd need a brute-force attack — which can take millions of years for complex passwords. This is why strong, random passwords are still the best defense.
Generating Custom Wordlists
Generic wordlists are a starting point, but the most effective wordlists are custom-built for your target. Kali Linux includes several tools for this.
Crunch — pattern-based generation
Crunch generates wordlists based on character sets and length constraints. It's pre-installed on Kali.
CeWL — scrape words from a target website
CeWL (Custom Word List generator) spiders a target website and builds a wordlist from the words it finds. This is highly effective because people often use company names, project names, and industry jargon in their passwords.
CUPP — profile-based password generation
CUPP (Common User Passwords Profiler) generates a targeted wordlist based on personal information about a specific individual — name, birthday, spouse, pet, etc. It exploits the fact that people use predictable password patterns based on their personal lives.
Cleaning & Manipulating Wordlists
Raw wordlists often contain duplicates, blank lines, and entries that are too short to be valid passwords. Here are essential bash one-liners for cleaning them up:
awk 'length >= 8 && length <= 63' to remove entries that can't possibly be valid — this dramatically reduces cracking time.
Managing Wordlists with wordlistctl
wordlistctl is a Kali tool that lets you search, download, and manage wordlists from multiple sources — all from one command:
Frequently Asked Questions
Which wordlist should I use for WPA2 WiFi cracking?
Start with rockyou.txt — it's the industry standard and cracks a surprising number of weak WiFi passwords. If that doesn't work, try the Probable Wordlists repository or generate a targeted list with CeWL based on the target network's name and location. Remember to filter out entries shorter than 8 characters since WPA2 requires at least 8.
What's the difference between a dictionary attack and a brute-force attack?
A dictionary attack tests each word in a wordlist as a potential password. A brute-force attack tries every possible combination of characters. Dictionary attacks are much faster but only work if the password is in the list. Brute-force is thorough but exponentially slower — an 8-character alphanumeric password has over 2.8 trillion combinations.
Why didn't the wordlist crack the password?
Because the target password isn't in the list. No wordlist contains every possible password. If the target uses a strong, unique password with random characters, no dictionary attack will work. Try using hashcat rules (-r best64.rule) to generate mutations of your wordlist, or build a targeted list with CeWL/CUPP.
How do hashcat rules make wordlists more effective?
Rules tell hashcat to automatically generate variations of each word in the list — like appending numbers (password123), capitalizing (Password), replacing characters (p@ssword), and adding years (password2026). The best64.rule file generates 64 variations per word, turning a 14M-entry list into 900M+ candidates without needing a larger file.
Do I need a GPU for password cracking?
For hash cracking with hashcat, a GPU is strongly recommended — a modern GPU like the RTX 4090 can test billions of hashes per second. For online attacks with hydra (SSH, web forms), CPU is fine since you're limited by network speed. For WPA2 with aircrack-ng, a GPU significantly speeds up the process.
Where does Kali store wordlists?
The default location is /usr/share/wordlists/. RockYou is at /usr/share/wordlists/rockyou.txt.gz (needs decompressing). SecLists installs to /usr/share/seclists/. Other tool-specific lists are scattered across /usr/share/ and symlinked from the wordlists directory.
