← All articles
DIY · The list
How to build a candidate password list
Of everything that happens in a recovery, this is the only part no machine can do and the one that weighs most on the outcome. Spend a whole afternoon on it, methodically, and you will have better odds than with any computer.
The rules of the exercise
- On paper, not on your phone or in the cloud.
- Unfiltered. Write down what seems unlikely too. A doubtful candidate is tested and discarded in a second; an unwritten one is never tested.
- Unhurried and across several sessions. Memory gives things back when you stop squeezing it.
- Don’t test anything yet. The whole list first, then the testing.
The questions that extract information
Don’t try to «remember the password». Answer these questions, which is far easier and yields far more:
- What passwords were you using at that time elsewhere? Write them all down, even if none is this one.
- Did you have a «good» password reserved for important things? Start there.
- Which words did you tend to use: names, pets, cities, teams, bands, characters?
- Which numbers: years, birthdays, plate numbers, house numbers, phone numbers?
- Where did you put the number: start, end, middle?
- Did you use capitals? Only the first letter?
- Did you use symbols? Which ones and where?
- Did you swap letters for similar-looking digits?
- Was it in your own language or in English?
- How many characters, roughly?
- Did you type it on a computer with a different keyboard layout?
The first question is the most productive of all and hardly anyone asks it. People don’t invent new passwords each time: we repeat structures. Five of your passwords from that period, even if none is the wallet’s, describe how you build them better than any direct memory.
Where to find your old passwords
- In your browser’s password manager, which keeps things from years ago.
- In managers you used and abandoned.
- In notebooks from that period.
- In old sign-up emails from services.
- By asking yourself which services you used then and what you logged in with.
How to organise the list
Split it into two columns: pieces and rules. The pieces are the specific words and numbers. The rules are the ways of combining them: «capitalised word + year», «two words run together», «word + symbol + number». With those two lists, a few pieces and a few rules generate thousands of ordered candidates, which is exactly what is needed.
When you no longer need it, destroy the paper. That list describes how you build all your current passwords, not just the wallet’s. And don’t email or message it to anyone: if it has to be used in a case, it is spoken, not written.