When Word Games Become Attack Vectors: The Quiet Journey of Public Wordlists

Every wordlist has an origin story. Some start life as a puzzle-maker's labor of love, others as a digitized novel from 1897, and a surprising number end up in the toolkit of a penetration tester running hashcat at 2 a.m. The journey from game board to attack vector is shorter than you'd think — and it raises questions that both security testers and word game enthusiasts should care about.

The Unlikely Supply Chain

Start with the Official Tournament and Club Word List (OTCWL), the lexicon competitive Scrabble players in North America commit to memory. It's a carefully curated collection of roughly 190,000 words, vetted for tournament play and fiercely protected by its publishers.

Now look at a spelling bee archive. The Scripps National Spelling Bee publishes word lists going back decades — obscure terms like "chiaroscurist" and "euouae" that a casual dictionary would miss. Puzzle builders love these for difficulty grading.

Then there's Project Gutenberg, the granddaddy of public domain text. Tens of thousands of books, free to download, free to redistribute, free to do... just about anything with.

All three feed the same ecosystem. Someone extracts the words, normalizes the casing, dedupes the entries, and ships a .txt file. That file might help a crossword constructor verify a tricky fill on Tuesday. By Friday, it's feeding a dictionary attack against a hash dump.

Why Human-Curated Lists Crack Better

There's a reason security testers reach for these sources instead of a raw system dictionary. Human-curated wordlists have personality.

Scrabble lists contain short, punchy words — the kind people actually type as passwords. "Qi," "za," "jo" — three letters, high frequency in game play, and devastatingly common as password fragments. Spelling bee archives surface the phonetic oddities that show up when someone thinks they're being clever with a "random" word. And literature-sourced corpora capture names, places, and phrases — the "Frodo," "Atticus," and "ToKillAMockingbird" entries that pure dictionaries miss.

A password cracker is only as good as its assumptions about human behavior. Word game lists encode decades of insight into which words humans find memorable. That's exactly what makes them dangerous when pointed at a credential database.

The Copyright Question Nobody Wants to Answer

Here's where it gets murky. A single word can't be copyrighted — that's settled law in the US. But a collection of words? That's where things get interesting.

The OTCWL is a copyrighted compilation. Hasbro and the North American Scrabble Players Association treat it as proprietary. Yet bootleg copies circulate freely on GitHub, buried in pentest repos and word game apps alike. The legal theory of compilation copyright says the selection and arrangement of the list is protectable, even if each individual word isn't.

Project Gutenberg, by contrast, is explicitly free — but it comes with a trademark and terms of use. You can use the texts, but you can't use the Gutenberg branding, and mass-redistribution has some guardrails. Most people scraping the site for wordlist material never read that far.

Spelling bee lists sit somewhere in between. The words themselves are public knowledge once spoken on stage, but the annual published lists are commercial products.

The practical reality: enforcement is rare, but not nonexistent. Word game apps have received cease-and-desist letters for shipping Scrabble lexicons. Security tools that bundle copyrighted lists have quietly pulled them from distribution. The gray zone is real, and it's getting less gray as rights holders pay attention.

What This Means for Security Testers

If you're building wordlists for authorized penetration testing, a few ground rules will keep you out of trouble:

• Verify the license before redistributing. Using a copyrighted list internally for a client engagement is one thing; committing it to a public repo is another.
• Build, don't copy. Deriving your own list from public domain sources — Gutenberg texts, government word frequency data, US Census name records — gives you a defensible chain of custody.
• Document your sources. If your wordlist ends up in a report or a court exhibit, knowing where every word came from matters more than you'd expect.
• Consider generation over curation. Rule-based generation (mangling, combinatorics, markov chains) sidesteps the licensing question entirely and often outperforms borrowed lists anyway.

What This Means for Puzzle Makers

The traffic runs both directions. Puzzle constructors should know that their favorite lexicons are also attack material — not because they need to worry, but because it explains why these lists keep getting scraped, mirrored, and argued about.

More practically: if you're building a word game or puzzle tool, shipping a copyrighted tournament list inside your app is a real legal risk, even if it's been the industry's open secret for years. The safer play is a licensed list, a public domain alternative, or a generated list filtered to your difficulty specs.

One Vocabulary, Many Uses

There's something almost poetic about it. The same 190,000 words that decide a Scrabble championship in Las Vegas can also decide whether a corporate password policy holds up. Words don't have intentions — people do. A list that helps one person build a better crossword helps another test a network's defenses.

The takeaway for both camps is the same: know where your words come from, know what the license says, and know that in the world of wordlists, nothing stays in its lane for long.

Whether you're generating candidate passwords for an authorized audit or building the next great anagram solver, the smartest move is the same one — build your lists deliberately, source them cleanly, and never assume a word list is "just a word list."