These lists are used by attackers or "script kiddies" with automated tools (often
awk -F':' 'print NF' combo_list.txt | sort | uniq -c
This guide explores what constitutes an HQ combo list, where to find them, and how to use them responsibly. What is an HQ Combo List?
A combo list is a text document containing pairs of credentials. The prefix implies that the list has been filtered, sorted, or refined to maximize validity. Unlike raw, public data dumps, high-quality lists undergo specific optimization processes. Key Characteristics of HQ Lists hq combo list download portable
. When a major website is compromised, hackers dump the database. They then use "leak checkers" to filter out junk data, leaving behind a refined "HQ" list that can be sold or shared in underground forums. The Cycle of a Credential Stuffing Attack Acquisition: An attacker downloads or buys a fresh combo list. Automation:
A combo list is a text file containing a large collection of stolen or leaked usernames, email addresses, and matching passwords. They usually follow a strict format: username:password email@domain.com:password
If your goal is to test your company's defense mechanisms against credential stuffing, or to verify if your employees' accounts have been compromised, you do not need to download sketchy public combo lists. Safe, legal, and highly efficient alternatives exist. 1. Have I Been Pwned (HIBP) API These lists are used by attackers or "script
The "HQ" (High Quality) prefix indicates that the data has been filtered or curated. Unlike raw, public leaks that contain millions of dead accounts, an HQ list typically features: : Clean data with unique entries.
is a text file containing pairs of credentials—usually formatted as email:password user:password The "HQ" Label:
| Format | Portable? | Pros | Cons | |--------|-----------|------|------| | .txt (RAW) | Yes | Direct use, no extraction needed | Large file size (5GB+ possible) | | .txt.gz | Yes | Compressed, fast decompression | Requires gzip on target machine | | .rar (WinRAR) | Yes | High compression ratio | Need unrar (Linux) or WinRAR (Windows) | | .7z | Yes | Best compression | Slower to decompress on old hardware | | .zip | Yes | Universal support | Worst compression ratio | The prefix implies that the list has been
A (short for combination list) is a text document containing a large collection of stolen or leaked username/email and password pairs. The term HQ stands for "High Quality," which in the context of data dumps implies that the credentials are fresh, valid, and have a high success rate when tested against various online services. These lists are typically formatted in one of two ways: Email:Password (e.g., user@email.com:Password123 ) Username:Password (e.g., admin_user:SecretPass! )
Allows organizations to cross-reference user passwords against known breaches at the moment of creation, forcing users to pick unique passwords.
help you generate and store unique, complex passwords for every site. Enable Multi-Factor Authentication (MFA):
Use tools like grep or specialized list cleaners to remove invalid formats.