Andy Lester

Technology, careers, life and being happy

401 passwords Twitter won’t let you use

| 2 Comments

Twitter has a list of 401 passwords that they disallow, not because of content, but because of how commonly used they are. A common password is easier for a bad guy to guess. None of these are passwords you’d want to use anyway, because they’re so easily guessable by a simple dictionary attack. Bad guys have lists like this anyway, and Twitter is trying to make the most common and unsafe passwords unusable. I wonder how many people would use “111111″ as a Twitter password if allowed.

The list is embedded in the JavaScript of the website. Search in the page source for “BANNED_PASSWORDS”. The list is ROT13-encoded, but with Perl that’s trivial to decode:

$str =~ tr[a-mn-z][n-za-m];

The list contains a fair amount of profanity and sexual language below, as you might expect, and geek words like “ncc1701“, “thx1138” and “rush2112“, but also plenty of sports teams like “steelers”, “broncos” and “arsenal”. Many common names like “jennifer” and “michael” show up as well. Note that shorter passwords like “asdf” aren’t included because Twitter requires a minimum of six characters for passwords anyway.

As I write this today, there are 401 passwords in the list, which is 31 more than were reported in 2009. It seems from that article that they weren’t ROT13ed at the time.

The full list (slightly expurgated) follows:

  • 000000
  • 111111, 11111111, 112233, 121212, 123123, 123456, 1234567, 12345678, 123456789, 131313
  • 232323
  • 654321, 666666, 696969
  • 777777, 7777777
  • 8675309
  • 987654
  • aaaaaa, abc123, abc123, abcdef, abgrtyu, access, access14, action, albert, alberto, alexis, alejandra, alejandro, amanda, amateur, america, andrea, andrew, angela, angels, animal, anthony, apollo, apples, arsenal, arthur, asdfgh, asdfgh, ashley, asshole, august, austin
  • badboy, bailey, banana, barney, baseball, batman, beatriz, beaver, beavis, bigdaddy, bigdog, birdie, bitches, biteme, blazer, blonde, blondes, bond007, bonita, bonnie, booboo, booger, boomer, boston, brandon, brandy, braves, brazil, bronco, broncos, bulldog, buster, butter, butthead
  • calvin, camaro, cameron, canada, captain, carlos, carter, casper, charles, charlie, cheese, chelsea, chester, chicago, chicken, cocacola, coffee, college, compaq, computer, consumer, cookie, cooper, corvette, cowboy, cowboys, crystal
  • dakota, dallas, daniel, danielle, debbie, dennis, diablo, diamond, doctor, doggie, dolphin, dolphins, donald, dragon, dreams, driver
  • eagle1, eagles, edward, einstein, erotic, estrella, extreme
  • falcon, fender, ferrari, firebird, fishing, florida, flower, flyers, football, forever, freddy, freedom, f—ed, f—er, f—ing, f—me, f—you
  • gandalf, gateway, gators, gemini, george, giants, ginger, gizmodo, golden, golfer, gordon, gregory, guitar, gunner
  • hammer, hannah, hardcore, harley, heather, helpme, hentai, hockey, hooters, horney, hotdog, hunter, hunting
  • iceman, iloveyou, internet, iwantu
  • jackie, jackson, jaguar, jasmine, jasper, jennifer, jeremy, jessica, johnny, johnson, jordan, joseph, joshua, junior, justin
  • killer, knight
  • ladies, lakers, lauren, leather, legend, letmein, letmein, little, london, lovers
  • maddog, madison, maggie, magnum, marine, mariposa, marlboro, martin, marvin, master, matrix, matthew, maverick, maxwell, melissa, member, mercedes, merlin, michael, michelle, mickey, midnight, miller, mistress, monica, monkey, monkey, monster, morgan, mother, mountain, muffin, murphy, mustang
  • naked, nascar, nathan, naughty, ncc1701, newyork, nicholas, nicole, nipple, nipples
  • oliver, orange
  • packers, panther, panties, parker, password, password, password1, password12, password123, patrick, peaches, peanut, pepper, phantom, phoenix, player, please, pookie, porsche, prince, princess, private, purple, pussies
  • qazwsx, qwerty, qwertyui
  • rabbit, rachel, racing, raiders, rainbow, ranger, rangers, rebecca, redskins, redsox, redwings, richard, robert, roberto, rocket, rosebud, runner, rush2112, russia
  • samantha, sammy, samson, sandra, saturn, scooby, scooter, scorpio, scorpion, sebastian, secret, sexsex, shadow, shannon, shaved, sierra, silver, skippy, slayer, smokey, snoopy, soccer, sophie, spanky, sparky, spider, squirt, srinivas, startrek, starwars, steelers, steven, sticky, stupid, success, suckit, summer, sunshine, superman, surfer, swimming, sydney
  • tequiero, taylor, tennis, teresa, tester, testing, theman, thomas, thunder, thx1138, tiffany, tigers, tigger, tomcat, topgun, toyota, travis, trouble, trustno1, tucker, turtle, twitter
  • united
  • vagina, victor, victoria, viking, voodoo, voyager
  • walter, warrior, welcome, whatever, william, willie, wilson, winner, winston, winter, wizard
  • xavier, xxxxxx, xxxxxxxx
  • yamaha, yankee, yankees, yellow
  • zxcvbn, zxcvbnm, zzzzzz

2 Comments

  1. I’m glad to see that “password” has been banned twice.

  2. The list should include passwords with variations of the word “GOD” in them like “GodImGood” “IamGod”. Think about it many programmers out there love this type of password for themselves, etc.

Leave a Reply

Required fields are marked *.