Even if you add "fake complexity"—like changing "password" to P@ssw0rd123! —cracking software is programmed to predict these exact substitutions.

At its core, a password list is a simple text file containing millions of entries. These lists are fed into automated software (like John the Ripper or Hashcat) that tries every word on the list against a login screen or an encrypted file until it finds a match. These lists generally fall into three categories:

The only way to win is to stop playing their word game. Move to passphrases, use a manager, and never rely on a single word again.