Compiling a custom passphrase wordlist

I compiled a custom wordlist to use when generating passphrases, and this site describes my approach. I had some dissatisfactions with the commonly recommended existing lists, so I put a little time into making one to my own specifications.

Here's my full custom wordlist if you want to explore the end result.

Before diving into the details, here's a passphrase generator that you can try out if you want to compare some sample passphrases generated by different wordlists.

Some background

Diceware is a method for generating passphrases using some dice and a list of words. You have a list of a certain number of words and roll some dice to pick random words from the list until you have as many as you want in your passphrase. I first learned about passphrases through Arnold G. Reinhold's Diceware Passphrase Home Page where you can read the detailed explanation if you want it.

Later, the Electronic Frontier Foundation (EFF) released New Wordlists for Random Passphrases. They listed several factors that motivated them to produce these alternative word lists, which are worth repeating in full here.

The Diceware list can provide strong security, but offers some challenges to usability. In particular, some of the words on the list can be hard to memorize, hard to spell, or easy to confuse with another word.

• It contains many rare words such as buret, novo, vacuo
• It contains unusual proper names such as della, ervin, eaton, moran
• It contains a few strange letter sequences such as aaaa, ll, nbis
• It contains some words with punctuation such as ain't, don't, he'll
• It contains individual letters and non-word bigrams like tl, wq, zf
• It contains numbers and variants such as 46, 99 and 99th
• It contains many vulgar words
• Diceware passwords need spaces to be correctly decoded, e.g. in and put are in the list as well as input.

The EFF team also attempted to remove words that are difficult to spell or are homophones. Combined with the removal of words that are an exact prefix of another word, they seem to have removed many of the shorter words entirely. The resulting word list is not really to my liking. The words range from 3–9 characters in length, with an average of 7 characters. For a 5-word passphrase with spaces or some other separator between the words, this is an average of 39 characters to type.

For comparison, Reinhold's original list ranges from 1–6 characters, averaging out around 4.25 characters per word. That's closer to 24 characters, on average, for a 5-word passphrase, which is already quite a lot to type if you type in your passphrase several times a day.

So, after years of dissatisfaction with the long passphrases generated from the EFF list, I finally decided to try compiling my own personal word list. In the spirit of the section from the EFF quoted above, here are my own objections to the Reinhold and EFF word lists that I hoped to address in my custom wordlist.

• The Reinhold list has some very short entries that can (rarely) generate passphrases that are too short to be secure. Reinhold's FAQ recommends discarding any passphrase shorter than 19 characters, but I would prefer not to generate them in the first place.
• The Reinhold list has some entries with punctuation, which I dislike in a passphrase.
• The Reinhold list has many entries that are not words at all, like those mentioned in the EFF remarks above.
• The words in the EFF list are too long to be convenient.
• I always use a space, hyphen, or other separator between words, so the EFF's concern about in, put, and input isn't relevant to me, and causes many perfectly good short words to be rejected.
• I have my own opinions about which words I am likely to be misspell or confuse for other words, and the EFF list seems to have removed many words that I would have accepted.

In short, I think that the EFF lists are a good attempt at a general-purpose solution, but I just don't like how many long words they have. The Reinhold words have better lengths, but lean too heavily into nonsense strings for my taste.

For a little more context, here's a brief explanation about how I personally use passphrases.

• Usually, I simply don't. For most of my password needs, I generate a completely random string of characters in a password manager and never type it in by hand or even look at it ever again.
• I use passphrases for logging into computers, for example, or for services that I want to be able to log into even if I'm away from my password manager, like email accounts.
• I tend to use passphrases that are 5 or 6 words long. This is about the limit of what I can conveniently remember.
• I always use a space, hyphen, or some other special character as a separator between words. Within a given password, all the separators are the same character.
• I want all the word list words to be lowercase English letters. If the service requires characters that don't appear in a generated passphrase, I will typically just tack something onto the end rather than making changes to the generated words.
• For compatibility with the original Diceware method, I wanted a list of 7,776 words. (This is the number of distinct rolls of five 6-sided dice.)
• Oh, also I sometimes want to use this list to generate two-word random usernames. I don't have a singular "online identity" and instead prefer to generate a random username for any service that requires one. The EFF list was never good for this because the words were just not as concise (or concrete?) as I wanted.

Compiling my custom wordlist

First, I wanted a list of words to start from. Almost any modern unix-based system has a handy list of words somewhere, and that's what I used. I pulled all the 3–6 letter words (no punctuation or accented characters) from this list into a file for review. At this stage, I kept words with uppercase letters, because I wasn't sure yet what I was going to want to keep.

egrep "^[a-zA-Z]{3,6}$" /usr/share/dict/words > mywordlist.csv

This provided 20,132 words to start with. As a reminder, my target is 7,776 words.

Next, I rejected some kinds of offensive words ("words of oppression") that I didn't want to see in my passphrases. I used dariusk's wordfilter list to identify candidates that I then reviewed manually. I wasn't trying to remove all profanity and crass language at this stage, just taking a first filter against words that I expected to find most objectionable.

This removed 70 words, leaving 20,062 words.

I de-duplicated words that appeared in both uppercase and lowercase forms. For example, I discarded Mark because mark was already in the list, but kept Wendy since there was no lowercase equivalent.

This removed 703 words, leaving 19,359 remaining.

Now I took a first major review pass. Over the course of several days, I manually looked at all ~19,000 words and made a snap judgement about whether each word should be kept, rejected, or "maybe" kept. Going into this, I didn't really have any sense of what my criteria were, but a few common patterns emerged.

• Several roman numeral numbers appeared in the list, like xii, clvi, and so on. I removed 54 of these, leaving 19,305 remaining.
• I removed most regular plurals, past tense, and a lot of "-ly" adverbs. I thought it would be confusing if some of my passwords contain slow and others contain slows or slowed or slowly, for example. I removed 5,922 of these, leaving 13,383 now.
• The "maybe" category ended up with a lot of archaic words, words that sounded only vaguely familiar to me, less-concrete words like but or why, some constructions like unsay or recopy that felt not quite natural enough. I went ahead and cut these 884 "maybe" words, leaving 12,523 words.
• The rest of the "no" list contained a lot of proper nouns (brand names and family names were rejected, most personal names were kept for now), abbreviations and initialisms like mph, illus, or VCR, uncommon variant spellings, and so on. I flagged 3,328 words in this "no" group, leaving 9,195 remaining.

In total, this first review removed 10,106 words, leaving 9,253 remaining. I was pretty happy with this first pass.

After a break (several days or weeks, I forget exactly), I took another pass, looking at each of the remaining words on the "keep" list again and just being a little more picky, especially for 5 and 6 letter words. I cut several more words with common prefixes like unbend and unsung, some words of three or even four syllables, like vivify and iambic, words that I personally might expect to write with a hyphen or as separate words, like nonfat or earwax, and some more profanity or crass words.

Surprisingly, I cut 1,431 words in this pass, leaving 7,764 remaining. I had overshot my target by only a dozen words!

After a few easy tweaks, I got back to 7,776 words, and pretty much called this project done. The words range in length from 3–6 letters and average just below 5 letters per word. For a 5-word passphrase with separators, that averages out to 29 letters, which is not too bad in my opinion.

The last step was to downcase any remaining words. I ended up with several hundred personal names, place names, and other miscellaneous proper nouns (now in lower case) like july and sunday.

I'm sure that there are still some words in the list that I might prefer to reject for various reasons. I could keep tweaking it if I really wanted to, but after hitting my target so nicely, I didn't want to spend more time over-thinking it.