Users frequently ask questions on how to generate custom wordlists like here or here. They usually have a particular tool in mind (e.g. crunch) and list a number of special criteria for the generated words (e.g. exactly one capital letter, three leading digits, etc.). These questions are usually well-received.

I understand that wordlists are used to crack passwords - which is a security topic. But generating your custom one seems to me like a very mundane coding task that doesn't relate to security knowledge in any way. Essentially, these questions are about scripting permutations of some kind. Additionally, the often very specific requirements make an answer unlikely to be helpful to anyone else.

Should I vote to close a question on custom wordlist generation or is there a good reason to encourage them?

  • And if they are to be closed, with what close reason?
    – Anders
    Commented Nov 28, 2016 at 23:21
  • @Anders I'd think off-topic because it's not about infosec.
    – Arminius
    Commented Nov 28, 2016 at 23:32
  • Unless it involves deciding what rulesets to use for a wordlist, which are very much related to information security.
    – guest
    Commented Nov 19, 2017 at 3:42

1 Answer 1


I think every single one I have seen is actually a programming question and not a security question. I think the red flag is when they are focussed on the desired output and not the tool. ("I want a list like X" vs "How does crunch work?").

A fine line we need to walk is the difference between a question that has information security as the core subject and a question that has potential security implications. Wordlist creation tends to be the latter. Questions about crunch are the former.

  • 2
    So I guess the close reason would be "Not about IS as defined in the help center"?
    – Anders
    Commented Nov 28, 2016 at 23:21
  • 1
    @Anders yes, or migrate to SO
    – schroeder Mod
    Commented Nov 29, 2016 at 7:12
  • 2
    On the other hand, if it focuses too much on the tool vs the actual effect - e.g. what type of password policies, entropy, etc - it might be more appropriate for SU.
    – AviD Mod
    Commented Nov 29, 2016 at 8:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .