Two Thousand Miles of Roadside Signage Taught Me Why Local Passwords Don't Travel

Somewhere outside Macon, Georgia, I realized I'd stopped reading road signs like a tourist and started reading them like a wordlist.

The trip was simple on paper: ride Interstate corridors from the Southeast up through the Midwest, then west to the Pacific Northwest, and photograph everything with letters on it. Gas stations. Motels. Diner specials. Church marquees. County fair banners. By the time I crossed into Oregon, my phone held something like 4,000 sign photos and my notes app looked like a linguistics grad student's fever dream.

What I came home with wasn't a scrapbook. It was evidence — evidence that the passwords people actually use are shaped by the businesses, brands, and spellings they pass every single day. And evidence that a generic top-10-million wordlist is going to whiff badly against someone whose digital life is anchored to their ZIP code.

The Buc-ee's Effect

Spend an hour in the parking lot of a Buc-ee's in Texas or a Wawa in New Jersey and you'll notice people treat these brands like local identity. That matters to anyone doing security testing, because brand loyalty has a funny way of showing up in credentials.

Bucees123, WawaGirl22, KwikTrip4me — these aren't hypothetical. Pet names and brand names are the two most common augmentation patterns hobbyists use when they build custom lists, and roadside brands are the pet names of commerce. If your target lives fifty miles from the nearest Wawa, including it in your list is noise. If they pass one twice a day, omitting it is a mistake.

The reverse is true too. A cracker running a list heavy on In-N-Out and Dutch Bros against a Florida target is burning cycles on brands the target has never seen. Regional mismatch is wasted work.

Spelling Drift Is Real and It's Measurable

Here's the quirk I didn't expect: spelling conventions themselves shift as you drive.

In the Southeast, I logged a surprising number of double-word compound names — “SunnySide,” “PineLevel,” “OakGrove” — smashed together with no space and inconsistent capitalization. Through the Midwest, Germanic and Scandinavian remnants showed up in business names: “Haus,” “Berg,” “Sons” with a period after it. By the time I hit Washington, the signage went casual and abbreviated — “Tacotime,” “Dang Good Coffee,” lowercase everything, apostrophes dropped.

Why does this matter for wordlists? Because people mirror the text they see. A customer who types “DutchBros” into a loyalty app forty times a month is far more likely to reuse that exact casing in a password than to type it the way a dictionary would render it. If your generator is normalizing capitalization, you're normalizing away the signal.

A Sampling Methodology You Can Actually Use

You don't need a cross-country road trip. You need a corridor and a system. Here's the protocol I settled on, tuned for repeatability:

1. Pick your corridors. Choose the interstates that actually pass through your target region — I-95, I-75, I-80, whatever's relevant. Businesses cluster at exits, and exits are where local attention lives.

2. Sample at fixed intervals. Every 25 miles, capture the signage at the nearest exit: one gas station, one food establishment, one roadside sign (church marquee, town welcome sign, school board). Fixed intervals keep you honest and prevent you from over-sampling the fun stuff.

3. Log the raw strings. Record the sign exactly as rendered — casing, spacing, apostrophes, intentional misspellings like “Kountry” or “Flyd”. Then log a normalized version separately. You want both layers.

4. Weight by proximity and frequency. A business visible from the highway gets a base weight. One with multiple locations in the area gets multiplied. The formula doesn't need to be fancy; a simple count of sightings per 100 miles works fine.

5. Run your augmentation rules against the local layer first. Years, leetspeak, keyboard walks, pet names — apply them to the regional tokens before you bother with the national ones.

What the Data Looked Like When I Got Home

After deduplication, the trip produced roughly 1,900 unique tokens. Maybe 15% overlapped with a standard common-password list. The rest — the local brands, town names, street-name compounds, diner specials, high school mascots — were invisible to any off-the-shelf list I ran them against.

That 85% is the whole argument for hyper-local wordlists in one number. When a pentest report says “we cracked 40% of passwords in six hours,” the hardware gets the credit. More often than not, the list did the heavy lifting, and the list won because it knew what town it was in.

The Ethics Stop on This Particular Highway

Standard disclaimer, but it's a real one: this methodology is for authorized testing. Sampling signage in public is fine. Testing credentials against systems you don't have permission to test is not, and “the sign told me the password” is not a legal defense. Use this to make your own audits sharper or your CTF writeups more interesting.

Roadside Intelligence, Summarized

If you take one thing from a 2,700-mile signage survey, let it be this: language is local before it's anything else. The internet flattened a lot of things, but it didn't flatten the gas station at exit 114 or the way a town spells its own name on a water tower.

Build your wordlists like a traveler, not a tourist. Stop at the exits. Read the signs. The locals already told you what they'd type.