rockyou.txt: How to Find and Use the Wordlist (2026)

What Is rockyou.txt?

rockyou.txt is a wordlist: a plain text file with one password per line, used to feed dictionary attacks against password hashes and login forms. It contains 14,344,392 lines, every one of them a password a real person chose, and no duplicates.

Uncompressed it is 139,921,507 bytes, which is 133 MB. Kali ships it gzipped at about 51 MB.

What makes it valuable is not the size. Plenty of generated lists are larger. rockyou.txt matters because it is a census of how people actually picked passwords, and human password habits have moved far less than you would hope. The list opens with 123456, 12345, 123456789, password, iloveyou, princess. Those still crack accounts in 2026.

It is sorted by frequency, not alphabetically. That detail matters more than most guides let on, and the section on what is inside the file shows why.

The 2009 Breach Behind rockyou.txt

RockYou was a company that made widgets for social networks: slideshows, glitter text, the kind of thing you embedded on a MySpace profile. To use one, you registered with your email address and, remarkably, the password to that email account.

In December 2009 someone walked out with the entire user table. The passwords were not hashed. They were sitting there as text.

The US Federal Trade Commission sued, and the resulting complaint is the primary source for what went wrong. Reading the government's own list of failures is more instructive than any breach post-mortem, because it names four specific mistakes:

• "unnecessarily collecting personal information from consumers in the form of email address passwords"
• "storing user's RockYou passwords, with associated email addresses, in clear text"
• "failing to segment its servers; once a hacker entered Defendant's network he or she was able to access all information on the network"
• failing to address "vulnerabilities in its system to web-based application attacks such as 'Structured Query Language' (SQL) injection attacks and 'Cross-Site Scripting' (XSS) attacks"

The complaint puts the damage at "approximately 32 million email addresses and RockYou passwords." RockYou settled in March 2012, paying a $250,000 civil penalty over the children's privacy charges and accepting twenty years of third-party security audits. You can read the FTC's announcement in full.

That 32 million figure is checkable. SecLists distributes a version of the list with occurrence counts attached, and adding up every count gives 32,603,388 accounts. The FTC's "approximately 32 million" and the file on your disk describe the same event.

Where to Find rockyou.txt in Kali Linux

On Kali, the file is installed by the wordlists package and lives at /usr/share/wordlists/rockyou.txt.gz. It ships compressed. Almost every "rockyou.txt not found" question traces back to someone looking for the .txt and not noticing the .gz.

Unpack it once:

sudo gunzip /usr/share/wordlists/rockyou.txt.gz
wc -l /usr/share/wordlists/rockyou.txt
# 14344392 /usr/share/wordlists/rockyou.txt

If wc -l gives you a different number, you have a mirror someone edited. Confirm the file with a checksum:

sha256sum /usr/share/wordlists/rockyou.txt
# 16035fea7742cb0561c513de1d946eda5716d7de294e6c732449740096686173

If the directory is empty, the package is not installed:

sudo apt update && sudo apt install wordlists

If apt reports that it cannot find the package, your mirror list is stale rather than the package missing. Run sudo apt update on its own first and try again.

On Parrot, Ubuntu, macOS and Windows

Outside Kali there is no distribution package. Get the file from SecLists, the standard collection maintained by Daniel Miessler, where it lives at Passwords/Leaked-Databases/rockyou.txt.tar.gz:

git clone --depth 1 https://github.com/danielmiessler/SecLists.git
cd SecLists/Passwords/Leaked-Databases
tar -xzf rockyou.txt.tar.gz

Parrot OS also has a wordlists package with the same layout. On Windows, Hashcat reads the file happily from any folder; the line endings in rockyou.txt are Unix-style and neither Hashcat nor John cares.

The same directory holds something most people never notice: pre-cut slices named rockyou-05.txt through rockyou-75.txt, running from 13 lines up to 59,186. Those are the correct choice for brute-forcing a live login form, where firing 14 million requests at somebody's SSH daemon is neither subtle nor kind.

What Is Actually Inside rockyou.txt

Guides describe the contents as "common passwords" and move on. We counted across all 14,344,392 lines, and the shape of the file explains most of the questions beginners have about when it works.

Start with composition:

That last row is the one to remember. A password policy nearly every corporate network enforces would reject 99.66% of rockyou.txt. The single most common shape in the file is a lowercase word with digits stuck on the end, which describes a third of the passwords 32 million people chose.

The second measurement is more useful for deciding how long to let a job run. Because the list is frequency-ordered, you can ask how much of the original user base each prefix of the file covers:

One thousand lines, 0.007% of the file, recover more than one account in ten. The first million lines recover more than half. The remaining 13.3 million lines are there for the long tail: 11,884,632 entries, 82.9% of the file, appeared exactly once across 32.6 million accounts.

In practice this changes how you work. Against a slow hash like bcrypt, running the head of the file first is not a shortcut, it is the correct order of operations. head -n 1000000 rockyou.txt > rockyou-1m.txt costs you nothing you were likely to find anyway, and finishes fourteen times sooner.

One last quirk: 14,534 lines contain non-ASCII bytes, things like *7¡Vamos! at the very end of the file. It is a rounding error at 0.1%, but it is why an occasional tool chokes on the list and complains about encoding when nothing else is wrong.

How to Use rockyou.txt With Hashcat, John and Hydra

The file is inert. What you do with it depends on whether you hold a hash or you are knocking on a live service.

Hashcat: offline hashes

Attack mode -a 0 is the straight dictionary run. Point it at the file and let the GPU work:

hashcat -m 1000 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

Add rules to get far more out of the same 14 million words. A rule set mutates each candidate, so best64.rule turns password into Password, password1, drowssap and sixty-odd other variants:

hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Rules are where crack rates come from, and our Hashcat tutorial walks through the attack modes properly.

John the Ripper: awkward formats

John reads the same file with --wordlist:

john --wordlist=/usr/share/wordlists/rockyou.txt --format=sha512crypt hashes.txt
john --show hashes.txt

John earns its place through the *2john family, which extracts a crackable hash from an encrypted file: zip2john, ssh2john, keepass2john, pdf2john.pl, and a few dozen more. That pipeline is a CTF staple:

zip2john secret.zip > zip.hash
john --wordlist=/usr/share/wordlists/rockyou.txt zip.hash

It also handles formats Hashcat does not, including the yescrypt hashes that are now the default on Debian 12 and Ubuntu 24.04. The John the Ripper guide covers those cases.

Hydra: live services, carefully

Online brute forcing is a different sport. Every guess is a network request that gets logged and counted, and enough of them will lock the account you were aiming at:

hydra -l admin -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou-75.txt \
      -t 4 ssh://10.10.10.5

Note the slice rather than the full file, and -t 4 rather than the default 16 threads. Throwing 14 million passwords at a login form is how you lock out the account you were trying to reach and put your engagement in an incident report. Use a short list, and stop when the target starts returning errors.

When rockyou.txt Stops Working

rockyou.txt fails constantly, and the failures follow a pattern. Reading the pattern saves hours.

The password is not in the list. Obvious, but people respond by downloading a bigger list when the better move is mutating the list they have. Rules multiply 14 million candidates into billions of realistic ones. Anything a human would type, a rule set probably generates.

The hash is deliberately slow. bcrypt, scrypt, Argon2 and yescrypt exist to make guessing expensive, and they succeed. Benchmark before you commit: run hashcat -b -m <mode>, divide 14,344,392 by the rate it reports, and you will know whether this is a coffee break or a weekend. If it is a weekend, use the top million lines instead.

The password is organisation-specific. No leak from 2009 contains Acme2026!. Build a target list with cewl, which scrapes a company's own website for vocabulary, then run rules over the result. Ten thousand words drawn from the target beats fourteen million drawn from strangers.

You are in a CTF and it should have worked. When rockyou.txt whiffs on a challenge, the answer is usually not a bigger wordlist. It is that you have the wrong hash type, the flag is hidden somewhere else, or the intended path was never cracking at all. Challenge authors know what rockyou.txt contains. If they wanted you to spend six hours on it, they would have said so.

The honest summary: rockyou.txt is a first attempt, not a strategy. It is fast, it is free, and it succeeds often enough that skipping it is never the right call. When it does not, the next step is a rule set or a custom list, never a download twice the size.

rockyou2021 and rockyou2024: Bigger Is Not Better

Search for rockyou and you will hit two much larger files borrowing the name. They are worth understanding mostly so you can decide not to bother.

rockyou2021.txt appeared on a hacking forum in June 2021 with 8,459,060,239 entries. rockyou2024.txt followed on 4 July 2024 with 9,948,575,739 unique plaintext strings, a figure verified by the researchers at Cybernews who analysed the upload.

Neither is a breach. Both are compilations, stitched together from thousands of older dumps plus generated filler, and neither has any real connection to the 2009 RockYou incident beyond the borrowed brand.

Three reasons they are less useful than their size suggests. They are unranked, so the frequency ordering that makes the original file efficient is gone. They are padded with generated strings no human ever typed. And at hundreds of gigabytes, feeding one to Hashcat turns a GPU job into a disk-read job.

Stick with the original 14 million and a good rule set. That combination outperforms ten billion unsorted strings on nearly every target you will meet, and it fits in RAM.

Legal and Ethical Considerations

rockyou.txt itself is about as legally settled as an offensive tool gets. It ships inside Kali Linux, it is used in university coursework, and its contents have been public for well over a decade. Downloading it is not the risky part.

Online brute forcing is where people get themselves in trouble. Password spraying a live login form generates logs, failed-auth alerts and locked accounts, and it does so under your IP address. Make sure credential attacks appear in your scope of work in writing before an engagement starts. "Penetration testing authorized" and "you may run Hydra against the VPN portal" are not the same sentence.

If you are on the defending side, the countermeasure is not a stricter complexity policy. NIST SP 800-63B recommends dropping composition rules and forced expiry in favour of longer passphrases plus screening every new password against known-breached lists. That last control is precisely a rockyou.txt lookup, run by the defender. The same file that cracks accounts also prevents the crack, which is a neat argument for knowing it well.