When Zyxel Got Banned: What Scrabble's Word Wars Teach Us About Curating Wordlists

In 2015, Scrabble players woke up to news that felt like betrayal. Thousands of words were being added to the official tournament dictionary — including one particularly spicy four-letter slur that had been quietly removed from the previous edition. The community split down the middle. Some players refused to acknowledge the new words. Others built their entire tournament strategy around them.

If you've ever maintained a wordlist — for cracking, for fuzzing, for puzzle construction — this story should feel familiar. Because Scrabble's dictionary wars are, at their core, a wordlist governance problem. And the security world has plenty to learn from how badly (and occasionally how well) it's been handled.

The Dictionary Nobody Actually Uses

Here's the funny part: Scrabble's official wordlists have almost nothing to do with how people actually speak. The North American tournament lexicon, maintained by the National Scrabble Association and published as the Official Tournament and Club Word List (OTCWL), is a curated snapshot of what the community decides counts.

Words like QI, ZA, and JO got in because players lobbied for them. Offensive slurs got pulled because sponsors and broadcasters complained. The list isn't descriptive — it's prescriptive, and every change is a negotiation between linguists, tournament organizers, and the players whose careers depend on the rules staying stable.

Sound familiar? It should. Anyone who's built a wordlist for penetration testing knows the same tension. Do you include the leaked password corpus everyone knows about, or keep the list clean for compliance reasons? Do you add the new default password for that IoT device, knowing it makes your list longer but your coverage better?

The Revolts Are the Feature, Not the Bug

The most famous Scrabble controversy wasn't the 2015 additions — it was the ongoing fight over removals. When words like the N-word slur were stripped from the tournament list, a group of prominent players published an open letter arguing that removing words hurt competitive integrity. Their logic: if the dictionary changes, decades of memorization and strategy become invalid overnight.

Security teams hit the same wall with every wordlist migration. Swap out your base wordlist mid-engagement and suddenly your crack rates aren't comparable to last quarter's numbers. Your dashboards lie to you. Your trends break.

The lesson from Scrabble isn't that change is bad. It's that versioning matters. Scrabble eventually solved this by publishing clearly versioned lexicons with defined effective dates for tournaments. Wordlist generators and security teams should steal this wholesale: every list gets a version, a changelog, and a sunset date.

Validity Is Contextual — Always

Ask a Scrabble player whether ZYZZYVA is a word and they'll say yes, instantly — it's a valid play in tournament. Ask a lexicographer and you'll get a shrug. Ask a password cracker and they'll tell you it's a terrible passphrase candidate.

Three communities, three answers, none wrong.

This is the core insight that Scrabble's wars hammer home: there is no such thing as a universally valid wordlist. Validity is defined by the game you're playing. A wordlist for dictionary attacks against US corporate email systems looks nothing like one for a crossword constructor or a linguist studying morphological patterns. The mistake isn't using the wrong words — it's pretending one list can serve every purpose.

When we build generators here, the question isn't "what words should be in the list?" It's "what game is this list playing?" Scrabble figured that out the hard way, through decades of player revolts and sponsor pressure.

Practical Takeaways for Your Next Wordlist Build

If you're generating wordlists for security testing, borrow a page from Hasbro's playbook:

• Publish your criteria. Scrabble's lexicon committee has documented rules for what makes a word eligible — length, citations, offensiveness policy. Write down yours, even if it's just a README.
• Version everything. A wordlist without a version number is a wordlist you can't reason about six months from now.
• Expect the revolt. Any change to a shared list will upset someone. That's not a failure — it's proof people care about the list. Announce changes early and give users a migration path.
• Separate the descriptive from the prescriptive. Scrabble separates its tournament lexicon from what Merriam-Webster publishes. Your cracking wordlist (descriptive — what people actually type) should be a different artifact from your policy document (prescriptive — what your team allows).

The next time someone hands you a wordlist with no provenance, no version, and no stated purpose, remember the Scrabble players who spent two years fighting over a dictionary update. Wordlists aren't just data. They're arguments, frozen into text files — and the good ones come with the receipts to prove it.