https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt Most Famous List: RockYou 2009 (cleaned) Size: 14.3 million unique passwords (cleaned version: ~1.4M after dedup) Why it’s legendary: First major real-world leak. Still relevant because users reuse the same patterns. Contains: 123456 , password , qwerty , iloveyou , monkey , dragon
https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt Best for "Most Common Only" (Top 100 / 1k / 10k) | Rank | Password (2023-2024 breach analysis) | |------|----------------------------------------| | 1 | 123456 | | 2 | password | | 3 | 123456789 | | 4 | 12345 | | 5 | 12345678 | | 6 | qwerty | | 7 | 1234567 | | 8 | 1234567890 | | 9 | 111111 | | 10 | 123123 | https://raw
Source: SecLists / Daniel Miessler Why it’s best: Aggregated from hundreds of real breaches (RockYou, LinkedIn, Myspace, etc.). Use case: First-pass audit. Covers ~90% of real user passwords. Use case: First-pass audit