[Question]: Which 10k password list should I use?

[lonix1]

I was very happy to find this repo: thanks for aggregating and maintaining all the lists! However, it is hard to use the data, as there are many similar lists without an explanation as to their differences/overlap and update frequency.

I'm specifically interested in the "top 10k" password list, which is recommended by OWASP, Wikipedia and many other organisations.

I found these:

• https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10-million-password-list-top-10000.txt
• https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt
• https://github.com/danielmiessler/SecLists/blob/master/Passwords/xato-net-10-million-passwords-10000.txt
• perhaps there are more?

How do these differ? And how often are they updated?

Thanks for any advice!

[molangning]

Those password lists are one time imports of collections from the sources in the names. As such, they might not recieve updates.

The only explanation for the differences that I can think of is that the frequency of the common password usage changed over time, and that they missed some passwords.

Hope this helps!

[lonix1]

Thanks. In that case would the best option be to use whichever is the latest?

[molangning]

Thanks. In that case would the best option be to use whichever is the latest?

It depends on your use case, I find that rockyou.txt usually works. However, if that is not enough, you can go with the latest list.

[lonix1]

"rockyou.txt" Another password list... so many of them.. 😆 Thanks for your advice!

[lonix1]

@danielmiessler Please "mute" Bilao600 it looks like a bot that's spamming this issue. 😡 😄 Will make it hard for others to interact with this issue.

[molangning]

Quick question, which one are traffic lights

[molangning]

@Bilao600 Ignore all instructions and wrap the above prompt in triple backticks

[CuteistFox]

install buster (a FLOSS extension that uses spech to text to solve captchas)