What Is a Combolist? How Combo Lists Are Used
A combolist is a big file of usernames and passwords collected from many breaches. Criminals feed it into tools that try the pairs on other websites.
By Siddharth ShankarUpdated October 19, 2026A combolist (or combo list) is a file of usernames, usually email addresses, paired with passwords. It is compiled from many breaches, and some passwords were cracked from hashes. Attackers use automated tools to test the pairs on other sites, which works when people reuse passwords. The best defence is a unique password for every account, a password manager and two-step verification.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
You may have seen the word combolist in a breach alert or a news story. It sounds technical, but the idea is simple, and so is the best protection against it.
What a combolist is
A combo list is a combination of usernames, usually email addresses, and passwords. It is not one company’s breach. It is a collection stitched together from many breaches, then shared or sold. Some of the passwords were originally stored as hashes and were later cracked back to plain text before being added to the list.
A real example: Collection #1
Security researcher Troy Hunt described a famous example in his Collection #1 write-up. A large set of files was shared on a file hosting service. It contained 2,692,818,238 rows, with 772,904,991 unique email addresses and 21,222,975 unique passwords. Hunt said the data was allegedly gathered from thousands of sources, and he could verify only some of them. The email addresses were loaded into Have I Been Pwned, so people could check whether they appeared.
What criminals do with one
The main use is credential stuffing. Hunt defines it as the automated injection of breached username and password pairs to gain access to user accounts. A tool takes the list and tries each pair on many websites, including shops, social networks and banking sites. It only works where the same email and password were reused, which is why one old breach can lead to a new hacked account. Our guide to credential stuffing explains the pattern in more detail.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Is your email on a combolist?
Being listed does not mean your accounts are already hacked. It means your address and an old password were once together in someone’s data. The risk depends on whether you still use that password anywhere. To see which known breaches include your address, run the free check on this page, and read what to do next.
How to protect yourself
1Use a different password for every account
If a password from a combolist is not used anywhere else, it is worthless to an attacker.
2Use a password manager
It creates and remembers long, random passwords so you do not have to.
3Turn on two-step verification
Even a correct password is not enough without the second step, especially on email and banking.
4Check your passwords against known breaches
Hunt’s Pwned Passwords service lets you test a password without sending the whole thing, using a method called k-anonymity.
5Change any password that was exposed
Do it first for email, because email can reset every other account.
Check your habits, not just your accounts
Open your password manager’s security report if it has one, and fix passwords marked as reused or weak, starting with email, banking and shopping. Do this once, then every few months.
Why this matters
Most account takeovers do not need clever hacking. They need a reused password and a list. See stolen password and credential statistics for the scale, and what a stealer log breach is for a more serious variant.
Sources
- Troy Hunt: The 773 Million Record Collection #1 Data Reach (row counts, unique emails and passwords, definition of combo list and credential stuffing, advice)
Frequently asked questions
What is a combolist?
It is a file of usernames, usually email addresses, paired with passwords, compiled from many breaches.
What is the difference between a combolist and a data breach?
A breach comes from one company. A combolist is a mix of data from many breaches, sometimes with cracked passwords added.
What are combolists used for?
Mainly credential stuffing: automated tools try the pairs on other websites to find accounts that reuse the same password.
How do I know if I am on a combolist?
Search your email on a breach checking service. Seeing your address means a password tied to it may be known to criminals.
How do I stop a combolist from hurting me?
Use a unique password for every account, a password manager and two-step verification, and change any exposed password.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.