clem9669/wordlists: French Password Dictionaries for Cracking and Pentesting

The French Password Gap This Repository Addresses

Most public wordlists, such as rockyou or hashes.org, are built from English-centric data. The README states that cracking passwords for English speakers is easier because English is the language of the internet. French passwords use different vocabulary, names, and patterns, so a generic list misses many candidates. This repository aims to provide French wordlists covering everything a person could use as a base password. It is for security professionals who perform password cracking in penetration tests, password recovery, or contests where the target population is French-speaking. The project also serves as a resource for researchers analyzing password habits in French-speaking regions.

What the Wordlists Contain and How They Are Built

The lists are assembled from multiple public sources. The README credits Wikipedia, Grammalect, SublimeText, weakpass.com, hashes.org, hashmob.net, packetstormsecurity.com, SecLists, and several other GitHub wordlist projects. It also mentions that keyboard walks are generated with kwprocessor, a tool from the hashcat project. A notable design choice is the removal of accented characters like œ, ï, ö, ä, ü, û, ô, î, â, and ë. The author explains that these are difficult to type, even though they appear in the French alphabet. This decision simplifies the lists but also means that passwords containing such characters will not be found unless a rule adds them. The project compiles three different versions of the wordlist, available in the Releases section. The README notes an update: the large and medium versions are too big for GitHub Actions, whose VM specs are 2-core CPU, 7 GB RAM, and 14 GB SSD. This implies that the compiled large and medium files might not be generated automatically, so users may need to build them from source files or rely on the small version.

Installation and Basic Usage

The repository does not require installation in the traditional sense. You clone it or download a release archive. The README gives a direct usage example with duplicut, a tool to deduplicate huge wordlists. The command is: duplicut wordlist.txt -o wordlist_uniq.txt. This suggests that the raw lists may contain duplicates, and deduplication is a recommended preprocessing step. For actual cracking, the README advises using a rule set, specifically the author's hashcat-rule project, because the lists alone are not enough. The workflow is: obtain the wordlist, optionally deduplicate it, then feed it to hashcat or John with a rule set. The releases section provides pre-compiled unique versions, but you must check the release notes for the exact combinations and sizes.

Cracking Contests and Real-World Validation

The README states that this repository and its associated rulelists have been used in several high-profile events. These include the KoreLogic Password Cracking contest at Defcon, cracking haveibeenpwned hashes released by Troy Hunt, the CrackTheCon contest, and SANS SEC courses. This is not a guarantee of quality, but it indicates that the project has seen practical use in demanding scenarios. The author's own participation in these contests likely drove improvements. For an engineer evaluating the project, this history suggests that the lists are not a toy; they have been tested against real-world password hashes. However, the README does not provide any success rates or statistics, so you cannot quantify the effectiveness.

Limitations and Failure Modes

The most obvious limitation is the removal of accented characters. French passwords often include é, è, à, ç, and others. The author removed them because they are hard to type, but many users still use them. A rule set might reintroduce them, but that is extra work. Another limitation is size. The README warns that the lists can be very big, and the large and medium compiled versions may not be generated due to GitHub Actions resource limits. If you need those versions, you might have to build them yourself, which requires significant disk and RAM. The project is also French-centric, so it is the wrong tool for non-French targets. Finally, the lists are static base dictionaries. They do not include context-specific mutations like dates, names, or company-specific terms. You must combine them with rules or masks to be effective.

Alternatives and How They Differ

A direct alternative is the SecLists project by Daniel Miessler, which includes a French wordlist section but is broader in scope. SecLists is not French-specific; it covers many languages and categories. The key difference is that clem9669/wordlists is curated specifically for French passwords, with a focus on the vocabulary and patterns that French users choose. Another alternative is the hashes.org or crackstation wordlists, which are general-purpose and English-heavy. The author's own hashcat-rule project is not a wordlist but a companion rule set that transforms base words into many variations. Using clem9669/wordlists without a rule set is less effective, as the README emphasizes. If you need a French-specific list, this project is unique; if you need a general list, others may suffice.

Maintenance, License, and Upgrade Cost

The repository is actively maintained. The last push was in August 2026, and releases are frequent, with versions 132, 133, and 134 appearing in July and August 2026. This indicates that the author updates the lists regularly, likely incorporating new leaks or contributions. The license is GPL-3.0, which means you can use, modify, and distribute the wordlists, but any derivative work must also be GPL-3.0. This is important if you plan to incorporate the lists into a commercial product; you must comply with the license terms. The upgrade cost is low: you can simply pull the latest release or clone the repository. However, if you have built custom deduplicated versions, you may need to redo that work after each update. The README also mentions a companion project, clem9669/weblist, for web discovery, which is separate and for pentesting resources.

Editorial conclusion

Adopt clem9669/wordlists if you are a pentester or security researcher targeting French-speaking users and need a ready-made dictionary base. Avoid it if your scope is primarily English or if you lack storage and processing power for multi-gigabyte lists. Before using, verify the exact release contents and size, and always pair the lists with a rule set like the author's hashcat-rule project. The project's maintenance is active, but the compiled large and medium lists may not be available due to GitHub Actions limits, so check the release assets first.

Frequently asked questions

Official sources

1. Official README
2. Project repository
3. Release notes