What is a combolist?

What is a combolist?

A combolist is a text file containing a list of usernames and passwords in a consistent format. Combolists are meant to be machine-readable so they can be used as input to tools that will automate authentication requests to a website or API.

A common example would be credential stuffing attacks. A tool like SentryMBA, an account checker, would use a combolist to automatically check which accounts are valid for a site. Once these accounts have been validated then they will be subject to a full account takeover and, inevitably, some sort of fraud.

Does this generate real combolists?

No, these are randomly generated fake credentials in a common combolist format.

Why did you build this?

It's useful to have sample combolists without real user data from an actual breach. For screenshots, presentations, etc.

How did you get my password?

If you see your password in here then it probably means that you are using either a common password or a password with a common base and a predictable prefix or suffix. You should change that.

How did you get my username AND password?

Well that's just bad luck. If that happens then 1. change your password because of the reason above and 2. either buy a lottery ticket because odds are in your favor or lock your house and stay in bed because odds are very much not in your favor. It depends on if you're a glass-half-full or glass-half-empty sort of person.

Can you help me?

If you came here because this site came up for terms like "credential stuffing" or "account takeover" then feel free to hit me up on twitter with questions or advice.

If you came here looking for real combolists then please look elsewhere. Or just keep refreshing the generator. Who knows, maybe you'll get lucky!