A Receipt for Your Wordlist: Why Every Dictionary Needs a Paper Trail

Wordlists get traded like recipes. Someone posts a file called best-list-final-v7.txt, someone else drops it into a cracking rig, and nobody asks where the ingredients came from. That is a supply-chain problem wearing a hobbyist’s hoodie.\n\nWe expect software to ship with a bill of materials. We expect datasets to have a license. We expect a recipe to list butter. A wordlist, apparently, gets a pass. That pass is getting expensive.\n\n## The handoff problem\n\nImagine you inherit a 2-million-line wordlist from a forum. It has no header, no README, and no license. Is it scraped from a public dictionary? Is it a merge of breach data? Was it deduplicated in 2019 and never touched again? Did someone add a mutation layer that triples every root? You cannot tell.\n\nThat matters for three reasons. First, legal risk: if you redistribute a list you do not have rights to, you are the problem. Second, reproducibility: if you cannot describe how a list was built, you cannot rebuild it or compare results. Third, quality: stale, duplicate-heavy lists waste time and inflate confidence.\n\nThis is not an argument for bureaucracy. It is an argument for a receipt.\n\n## What a dictionary bill of materials should contain\n\nA dictionary bill of materials, or DBOM, can be small. It needs enough information for someone else to answer: where did this come from, what can I do with it, when was it made, and how was it mutated?\n\nAt minimum, include the source, license, creation date, SHA-256 hash, line count, dedupe method, and mutation budget. The mutation budget is the part people forget. If a list was generated from 500 roots with 12 rules and 4 separators, that is very different from 500 roots with no rules. Record the rules, the maximum variants per root, and whether leetspeak was applied before or after deduplication.\n\nUnknown is an acceptable value. Undeclared is not. If you do not know the license, write UNKNOWN and do not redistribute the list. If the source is a private scrape, say so and keep it private. If the list contains breach data, treat it as radioactive and document the authorized use case.\n\n## A minimal JSON manifest\n\nHere is a small manifest that is useful without being theatrical:\n\njson\n{\n \"name\": \"us-event-250-2026.txt\",\n \"source\": [\"manual curation\", \"official event pages\"],\n \"license\": \"CC0-1.0\",\n \"created\": \"2026-11-10\",\n \"sha256\": \"9f2c...replace-me\",\n \"lines\": 18432,\n \"dedupe\": \"lowercase, sort -u\",\n \"mutation_budget\": {\"rules\": 6, \"max_variants_per_root\": 48},\n \"notes\": \"No breach data. Authorized testing only.\"\n}\n\n\nThat is not a legal contract. It is a trail. It tells the next person that the list was intentionally built, bounded, and dated. It also gives you a hash to verify after transfer, which is more than most wordlist threads offer.\n\n## Generate the boring parts\n\nYou do not need a platform to make this happen. A tiny script can emit the skeleton manifest next to the list:\n\npython\nimport hashlib,json,sys,os,datetime as d\np=sys.argv[1];b=open(p,'rb').read()\nprint(json.dumps(dict(file=os.path.basename(p),sha256=hashlib.sha256(b).hexdigest(),lines=len(b.splitlines()),created=d.date.today().isoformat(),license=(sys.argv[2:]or['UNKNOWN'])[0]),indent=2))\n\n\nRun it after deduplication, not before. Hash the file you actually plan to ship. If you apply another mutation pass later, bump the manifest. Version the list the same way you would version code.\n\n## Make provenance the default\n\nThe best way to fix wordlist provenance is to make the receipt cheaper than the excuse. Name files with a date. Keep the manifest beside the list. Include the hash in forum posts. Do not mix licenses in one file unless you document the mix. Do not claim a list is clean just because it has no duplicates.\n\nThe objection is predictable: this slows me down. It does, for about thirty seconds. It also prevents the much slower conversation where you explain why your testing rig is using an unlicensed list of unknown origin.\n\nWordlists are infrastructure now. Treat them like it. A dictionary bill of materials is not paperwork for its own sake. It is a receipt for the ingredients, the kitchen, and the date the batch was made.