What is the recommended approach to building dictionaries for password cracking projects?

• A. Use a single generic dictionary
• B. Build per project dictionary
• C. Random letters only
• D. No dictionary

Answer: (B)

Focusing on the target environment when building a dictionary makes password cracking far more effective. A per-project dictionary captures terms people are likely to use in that specific context—organization names, product lines, department terms, locations, project code names, and even commonly observed employee surnames or vendor acronyms. Including these domain-relevant words, and then expanding them with common password patterns through mutations (like capitalization, leetspeak, or added digits), targets realistic user behavior rather than random strings. This approach dramatically improves hit rates because it aligns the dictionary with how users actually form passwords in that environment. In contrast, a single generic dictionary misses many domain-specific terms, random-letter approaches rarely resemble real passwords, and skipping a dictionary in favor of brute force is far less practical for typical targets.