>passw0rd may be in the dictionary, but is p4ssword, or pa$$word? I'm guessing yes. If I were building a dictionary, I would add every password that's been du

>passw0rd may be in the dictionary, but is p4ssword, or pa$$word? I'm guessing yes. If I were building a dictionary, I would add every password that's been dumped from sites like Gawker, etc. With hundreds of thousands of passwords floating around in the ether, you can quite quickly cover common leetifications. Also, it's trivially easy to leetify algorithmically, so padding a dictionary wouldn't be difficult. You'll run into space issues eventually, but you can easily split the dictionary over several machines. The best solution for the user is to pick a fairly complex, long, and unique password. Server-side, assume your database will be compromised use something like bcrypt to make cracking it computationally expensive.