# How to Use SecLists for Password Cracking: A Complete Guide to Credential Testing

> Learn to use SecLists for password cracking. Clone the repository and utilize wordlists from the Passwords directory with Hashcat or John the Ripper for effective credential testing.

- Repository: [Daniel Miessler 🛡️/SecLists](https://github.com/danielmiessler/SecLists)
- Tags: how-to-guide
- Published: 2026-03-03

---

**Clone the danielmiessler/SecLists repository and point your cracking tool at files in the `Passwords/` directory, such as [`openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/openwall.net-all.txt), to perform straight wordlist attacks with Hashcat or John the Ripper.**

SecLists is the security industry’s standard collection of wordlists for penetration testing and credential assessments. The repository organizes millions of potential passwords into categorized plain‑text files, compressed archives, and metadata‑rich variants that integrate directly with modern cracking engines. Whether you are conducting offline hash recovery or targeted credential stuffing, SecLists provides the structured dictionary data required to mount efficient attacks.

## Understanding the SecLists Repository Structure

The danielmiessler/SecLists project uses a flat, navigable directory structure designed for automation. For password cracking workflows, four components are essential:

- **`Passwords/`** — Contains the core wordlists, including [`openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/openwall.net-all.txt) (approximately 2 million entries) and references to external datasets like `rockyou.txt.gz`.
- **[`Passwords/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/README.md)** — Documents each list’s source, expected size, and recommended use case.
- **`Passwords/withcount/`** — Optional subdirectory housing frequency‑aware variants that prioritize high‑occurrence candidates.
- **`.bin/`** — Utility scripts such as [`xml-parser.py`](https://github.com/danielmiessler/SecLists/blob/main/xml-parser.py) for generating tailored wordlists from structured data.

The repository is version‑controlled, allowing you to pin specific file hashes in your cracking pipelines for reproducible results.

## Installing and Accessing SecLists

Retrieve the repository using a shallow clone to minimize disk usage, or download the compressed archive if Git is unavailable.

```bash

# Shallow clone (recommended, excludes full history)

git clone --depth 1 https://github.com/danielmiessler/SecLists.git

# Alternative: Download and extract ZIP

wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecLists.zip && unzip SecLists.zip

```

The main [`README.md`](https://github.com/danielmiessler/SecLists/blob/main/README.md) documents these installation methods and attribution requirements.

## Selecting the Right Password Wordlists

The `Passwords/` directory offers tiered options based on attack scope and hardware constraints:

- **[`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt)** — A general‑purpose list with roughly 2 million entries, suitable for rapid, broad‑spectrum testing.
- **`Passwords/rockyou.txt.gz`** — A high‑volume dataset exceeding 14 million entries (downloaded externally per [`Passwords/README.md`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/README.md)), ideal for offline brute‑force campaigns.
- **`Passwords/SCRABBLE-hackerhouse.tgz`** — A 589 000‑entry list containing uppercase, lowercase, and single‑digit suffix mutations, optimized for dictionary‑style guessing.

Verify list integrity before execution by inspecting the first few lines:

```bash
head -n 5 SecLists/Passwords/openwall.net-all.txt

```

All plain‑text files contain one candidate per line; compressed archives must be decompressed prior to use.

## Integrating SecLists with Hashcat

Hashcat consumes SecLists files directly via the `-a 0` (straight) attack mode. Reference the absolute or relative path to any file under `Passwords/`.

Basic MD5 cracking:

```bash
hashcat -m 0 -a 0 -o cracked.txt hashes.txt SecLists/Passwords/openwall.net-all.txt

```

- `-m 0` specifies the MD5 hash type; adjust this to match your target algorithm.
- `-o cracked.txt` defines the output file for recovered plaintexts.

To expand candidate generation without enlarging the base dictionary, apply Hashcat’s built‑in rules:

```bash
hashcat -m 0 -a 0 -r rules/best64.rule -o cracked.txt hashes.txt SecLists/Passwords/openwall.net-all.txt

```

Rules mutate base words (e.g., appending digits, substituting characters) at runtime, increasing coverage while keeping the wordlist file compact.

## Integrating SecLists with John the Ripper

John the Ripper accepts SecLists via the `--wordlist` parameter. The syntax supports both standard and count‑aware variants.

Standard wordlist attack:

```bash
john --wordlist=SecLists/Passwords/openwall.net-all.txt --format=raw-md5 hashes.txt

```

For prioritized cracking using frequency data, use the `withcount` directory and enable mode 2:

```bash
john --wordlist=SecLists/Passwords/withcount/openwall.net-all-withcount.txt \
     --wordlist-mode=2 --format=raw-md5 hashes.txt

```

Mode 2 instructs John to attempt higher‑frequency passwords first, potentially reducing time‑to‑credential on statistical targets.

## Advanced Techniques for Password Cracking

### Combining Multiple Wordlists

Concatenate several SecLists files to maximize coverage. Decompress archives inline to avoid intermediate storage:

```bash
gunzip -c SecLists/Passwords/rockyou.txt.gz > rockyou.txt
cat SecLists/Passwords/openwall.net-all.txt rockyou.txt | tr -d '\r' > combined.txt
hashcat -m 0 -a 0 -o cracked.txt hashes.txt combined.txt

```

### Generating Custom Candidates

The `.bin/` directory contains helper scripts for targeted list creation. Extract XML tag contents to build context‑specific dictionaries:

```bash
python3 SecLists/.bin/xml-parser.py target-data.xml > custom-list.txt
hashcat -m 0 -a 0 -o cracked.txt hashes.txt custom-list.txt

```

This technique is effective when you possess partial knowledge of the target’s password construction scheme.

## Summary

- **Clone** the repository shallowly with `git clone --depth 1` to obtain the latest wordlists.
- **Select** dictionaries from `Passwords/` based on attack scope: [`openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/openwall.net-all.txt) for general use, `rockyou.txt.gz` for comprehensive offline attacks.
- **Execute** straight wordlist attacks using `hashcat -a 0` or `john --wordlist`, referencing exact file paths.
- **Enhance** coverage by applying Hashcat rules (`-r rules/best64.rule`) or using John’s `--wordlist-mode=2` with `withcount` variants.
- **Customize** lists using [`.bin/xml-parser.py`](https://github.com/danielmiessler/SecLists/blob/main/.bin/xml-parser.py) or shell concatenation for targeted scenarios.

## Frequently Asked Questions

### What is the best SecLists wordlist for general password cracking?

The **[`Passwords/openwall.net-all.txt`](https://github.com/danielmiessler/SecLists/blob/main/Passwords/openwall.net-all.txt)** file is the optimal starting point for general assessments. It contains approximately 2 million unique entries curated from real‑world breaches, balancing coverage and cracking speed. For high‑value targets with sufficient compute time, supplement it with `rockyou.txt.gz` after decompression.

### How do I use SecLists with Hashcat rules?

Reference the SecLists wordlist as the dictionary argument and append the `-r` flag pointing to a Hashcat rule file. For example:

```bash
hashcat -m 0 -a 0 -r rules/best64.rule -o cracked.txt hashes.txt SecLists/Passwords/openwall.net-all.txt

```

Rules programmatically modify each base word (e.g., `Password` → `Password1`, `P@ssw0rd`) without requiring manual list edits.

### What are the withcount files in SecLists?

Files located in **`Passwords/withcount/`** include frequency metadata alongside each candidate, indicating how often the password appeared in source breaches. John the Ripper can leverage this data via `--wordlist-mode=2` to attempt statistically common passwords first, improving efficiency against large hash dumps.

### Can I generate custom wordlists using SecLists utilities?

Yes. The repository includes scripts in `.bin/`, such as **[`xml-parser.py`](https://github.com/danielmiessler/SecLists/blob/main/xml-parser.py)**, which extracts tokens from XML documents to generate bespoke wordlists. This is useful when targeting specific organizations or applications where passwords may contain project‑specific terminology not found in general dictionaries.