The DMV Is Sitting on a Wordlist Goldmine (And Nobody's Mining It)

Ask most people where wordlist material comes from and they'll say rockyou.txt, maybe a leaked breach corpus, maybe the SSA baby names dataset (which we've covered before). What almost nobody says is: the Department of Motor Vehicles.

That's a mistake. State and local government data is public, structured, deeply regional, and — most importantly for anyone building targeted wordlists — full of words people actually chose to identify themselves with. Let's dig into what's hiding in plain sight.

Vanity Plates: Self-Selected Password Hints, Stamped in Metal

Every state publishes its vanity plate rules. Some, like California and Texas, even maintain searchable databases where you can check whether a plate configuration is taken. That's not just a curiosity — it's a window into how tens of thousands of residents describe themselves in eight characters or fewer.

Think about what shows up on plates: sports teams (GOBHAWKS, SOXRULE), kids' names, dog breeds, hometown pride (MKE4EVR), fishing spots, anniversary years. Now think about what shows up in password audits: the exact same categories. A person who pays extra to put LAKELIFE on their car is statistically more likely to use lake-themed strings in their credentials.

A few states have done the work for you. Researchers and FOIA requesters have pulled full vanity plate registration lists in some cases, and even when you can't get the full dataset, the published rules — allowed character counts, banned combinations, restricted words — tell you the shape of the space. Build your generator around those constraints and you're modeling real human choices, not random strings.

Slogans, Mottos, and the Lexicon of Civic Pride

Every state has official baggage: a motto (New Hampshire's "Live Free or Die" is practically a passphrase already), a nickname (Sooner State, Hoosier State, Badger State), and usually a tourism slogan that changes every few years — remember Virginia is for Lovers, Pure Michigan, or Idaho's infamous "Great Potatoes. Tasty Destinations."?

These phrases leak into everyday life. They're on highway signs, license plate frames, coffee mugs, and yes, passwords. A resident of Wisconsin doesn't need to be a security expert to have "badgers" rattling around their mental lexicon. Municipal naming conventions compound this: every town in the Midwest with a Centerville, a Springfield, a Washington Township adds predictable tokens to the local vocabulary.

For a red teamer working a regional engagement, this is exactly the kind of context that separates a targeted list from a generic one. For a puzzle builder, it's a themed lexicon with genuine cultural texture.

How to Actually Build the List

The pipeline is simpler than you'd think:

1. Collect the sources. State mottos and nicknames from official government sites (Wikipedia's lists are fine for prototyping, but cite the primary source). Tourism slogans from the state's official travel bureau. Vanity plate rules from each DMV's website.
2. Scrape politely. Most of this data is static HTML. A simple script with a rate limit and a proper user agent will do. If a state offers a plate availability checker, note that hammering it violates most terms of service — stick to published datasets and documentation.
3. Normalize aggressively. This is where the real work happens. Strip punctuation from "Live Free or Die" and you get livefreeordie, livefree, ordie, lfod (the abbreviation people actually use). Generate acronym variants for every multi-word slogan. Apply your usual leetspeak and case-mangling rules afterward.
4. Layer in geography. Combine slogan tokens with the state's top cities, area codes, ZIP prefixes, and major universities. A Michigan list should weight Detroit, Ann Arbor, 313, and wolverines far above anything generic.
5. Deduplicate and rank. Feed the result through a frequency sort. Slogan-derived tokens should sit high in the list; obscure municipal trivia can anchor the tail.

The whole thing is a weekend project, and it produces a list that no off-the-shelf dictionary can replicate.

Why Generic Dictionaries Miss This

rockyou.txt and its cousins are national — arguably global — corpora. They average out regional flavor. Nobody in Miami is choosing "packers," and nobody in Green Bay is choosing "finsup." Generic lists contain the intersection of everyone's vocabulary; targeted lists should contain the union of a specific community's vocabulary, weighted by local relevance.

Local government data is the cheapest, most legally unambiguous source of that community lexicon. It was collected by the state, published for public consumption, and reflects how residents actually label themselves. That's rarer than it sounds — most personal data sources come with ethical or legal baggage. Slogans and plate rules don't.

A Word on Responsible Use

The usual disclaimer applies, and it's worth meaning it: geographic wordlists are for authorized testing, CTFs, and puzzle construction. The same regional awareness that makes your cracker smarter is also, honestly, just good linguistics — it's the same instinct a crossword constructor uses when they lean on regionalisms for a themed grid.

The next time you're building a location-aware list, skip the generic databases for an afternoon. Start with your target state's DMV website instead. The goldmine is public, and the shovel is a Python script.