{"id":359,"date":"2026-08-17T05:34:52","date_gmt":"2026-08-17T05:34:52","guid":{"rendered":"https:\/\/texttoolz.com\/blog\/?p=359"},"modified":"2026-08-17T05:34:52","modified_gmt":"2026-08-17T05:34:52","slug":"leetspeak-explained","status":"publish","type":"post","link":"https:\/\/texttoolz.com\/blog\/leetspeak-explained\/","title":{"rendered":"What is leetspeak, and why is it called that?"},"content":{"rendered":"

Leetspeak is a substitution alphabet: letters are replaced by digits and punctuation that resemble them, so elite becomes leet and leet becomes 1337.<\/strong> Every page that explains it publishes the same table and none of them counts anything, so two questions go unanswered. The first is how much of the alphabet a leet map actually reaches: texttoolz’s own basic map covers 6 letters of 26, and its widest map covers all 26. The second is what the substitutions buy you. The word password has exactly 54 distinct spellings under the basic map, which is 5.8 bits of added unpredictability, so a 14-million-word dictionary expands to 756 million candidates, a set a modern cracking rig treats as routine. Google’s answer box says leetspeak is used to secure passwords. The first source it cites says the opposite, and this page shows the arithmetic that settles it.<\/p>\n

Where did leetspeak come from?<\/h2>\n

Leetspeak began on bulletin board systems in the 1980s, where a spelling nobody outside the scene could parse did two jobs at once: it marked the writer as an insider, and it slipped past the automated word filters those systems used to police file names and message topics. The name is elite compressed to leet, then written in its own alphabet as 1337.<\/p>\n

It spread through multiplayer gaming in the 1990s and 2000s, which is where most people met it, and where its vocabulary hardened into the handful of words that outlived the style. The filter-avoidance origin is history rather than instruction: modern moderation systems normalise these substitutions before matching<\/strong>, because the table is public and has been for forty years, so writing a word in leet no longer hides it from anything. That is also why this page stops at the history and does not publish a current recipe for getting text past a filter.<\/p>\n

Which letters does a leet map actually cover?<\/h2>\n

Coverage is the number nobody publishes, and it is the number that decides everything else. The table below counts the three maps in the texttoolz generator.<\/p>\n\n\n\n\n\n\n\n
The three substitution levels in the texttoolz leetspeak generator, counted by how many of the 26 letters each one replaces.<\/caption>\n
Level<\/th>\nLetters covered<\/th>\nWhich letters<\/th>\n<\/tr>\n<\/thead>\n
basic<\/td>\n6 of 26<\/td>\na e i o s t<\/td>\n<\/tr>\n
moderate<\/td>\n18 of 26<\/td>\na b c e f g h i l o s t u v w x y z<\/td>\n<\/tr>\n
extreme<\/td>\n26 of 26<\/td>\nthe whole alphabet<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Read the first row as the reason basic leet is still readable: four fifths of the alphabet is untouched, and the eye fills in the rest. Read the last row as the reason extreme leet is not: once every letter is a construction such as |\\\/|<\/code> for m or \\\/\\\/<\/code> for w, the word is a drawing rather than a spelling, and the character count roughly triples.<\/p>\n

The two substitutions people ask about most sit in the wider maps rather than the basic one. 9 stands in for g<\/strong>, on the strength of the shape, and 2 stands in for z<\/strong> in spelling, while in leet vocabulary it also carries the word to. Both are shape-based rather than sound-based, which is the general rule for the whole table: leet substitutes what a character looks like, not what it sounds like. The leetspeak generator<\/a> exposes the three levels above as options.<\/p>\n

One structural fact separates leet from every other text trick on this site. Its substitutes are drawn from the characters already on a keyboard, so leet stayed inside ASCII while the styled alphabets people copy today live in Unicode blocks nobody can type. That constraint is why leet had to build letters out of two or three characters once it ran past the obvious digits: there is no single keyboard character shaped like an m, so extreme leet writes one as |\\\/|<\/code>. It is also why leet travels through systems that reject anything unusual, since a filter, a form or a legacy database that refuses accented letters has no objection to |<\/code>, $<\/code> and 0<\/code>.<\/p>\n

Does leetspeak make a password stronger?<\/h2>\n

No. Substituting letters adds a fixed and very small amount of unpredictability, and it adds it in exactly the way password-cracking tools already expect. The counts below are the product of the options available for each letter of the word, including the option of leaving the letter alone.<\/p>\n\n\n\n\n\n\n\n\n
Distinct spellings of four common passwords under the basic leet map, with the unpredictability each set adds.<\/caption>\n
Word<\/th>\nDistinct leet spellings<\/th>\nBits added<\/th>\n<\/tr>\n<\/thead>\n
password<\/td>\n54<\/td>\n5.8<\/td>\n<\/tr>\n
letmein<\/td>\n24<\/td>\n4.6<\/td>\n<\/tr>\n
dragon<\/td>\n6<\/td>\n2.6<\/td>\n<\/tr>\n
monkey<\/td>\n4<\/td>\n2.0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Put the top row against a real word list. A 14-million-word dictionary crossed with 54 basic variants is 756 million candidates<\/strong>, and a rule-based attack generates exactly that set, because the rules are the same substitutions in the table above. Specops Software, writing on precisely this, describes cracking tools that run permutations such as replacing a with @, s with $ and o with 0, and concludes that a password like P4$$w0rd! “isn’t clever, it’s expected”, applied automatically “often within seconds”. The same article reports an analysis of 10 million breached passwords in which only 1.5% met a threshold of 15 or more characters with at least two character types.<\/p>\n

That article is the first source cited by Google’s own AI Overview on this query, and the overview’s summary of it reads: leetspeak is “frequently used today to add required numbers and symbols to secure passwords”. The overview and the source it cites take opposite positions<\/strong>, and the rest of the ranking set corroborates the source: Lenovo, ranking sixth, writes that leetspeak “is not a form of encryption, as it does not provide any substantial level of security or confidentiality”.<\/p>\n

The synthesis neither of them writes down is the one the counts give you. Substitution adds bits that an attacker’s rule set already contains; length adds bits it cannot enumerate.<\/strong> Turning password into p4$$w0rd adds under 6 bits and moves you inside a list. Adding four more words to a passphrase adds far more and moves you outside it.<\/p>\n

Is leetspeak a form of encryption?<\/h2>\n

Leetspeak is not encryption. It is a public substitution table anyone can reverse by eye, and encryption requires a secret that the reader does not already have.<\/p>\n

Lenovo states it most cleanly of anything in the ranking set, and the mechanism behind that sentence is the useful part: a cipher’s security lives in a key, not in the method, and a substitution scheme printed on a hundred web pages has no key at all. A cipher with an actual key, even a simple historical one, works differently, which the Caesar cipher decoder<\/a> demonstrates.<\/p>\n

How do you read leetspeak back into English?<\/h2>\n

Read digits as the letters they resemble, read punctuation as the shape it draws, and treat whatever is left as a deliberate misspelling. That handles nearly all of it: 7h3 |23d 4rr0w<\/code> resolves to the red arrow once 7 reads as t, 3 as e, |2<\/code> as r, 4 as a and 0 as o.<\/p>\n

Two ambiguities make a mechanical decoder harder to build than an encoder, and they are worth knowing before trusting one. The digit 1 stands for both i and l<\/strong>, so 1337<\/code> and the word list both depend on context, and 2 stands for both z and the word to<\/strong>. A decoder has to guess, and the guess is why leet decoding stays a reading skill rather than a solved conversion.<\/p>\n

Which words are leet vocabulary rather than substitutions?<\/h2>\n

Part of leetspeak is not substitution at all: it is a small vocabulary that spread with the style and cannot be recovered by any table. n00b came from newbie, pwned from a mistyped owned, haxor from hacker by way of the -xor suffix, and w00t from a cheer whose origin is disputed on every page that mentions it.<\/p>\n

The suffix pattern is the productive part, turning a noun into an agent with -xor or -z0r, so hacker becomes haxor and talker becomes t4lkz0r. The distinction that matters is reversibility<\/strong>: substitution is undone by a table, vocabulary is not, so a decoder handed n00b returns noob and stops, leaving the reader to supply newbie. Four of the nine pages examined here carry this vocabulary, and none separates it from the substitution table.<\/p>\n

What does writing in leet cost you?<\/h2>\n

Leet has four costs, and one of them behaves differently from every other text transformation on this site.<\/p>\n

    \n
  • Searches stop matching.<\/strong> The string p4$$w0rd does not contain password, so a search for the plain word never finds the leet handle. Any username written this way is invisible to people looking for the name.<\/li>\n
  • Normalisation does not undo it.<\/strong> Applying Unicode compatibility normalisation to p4$$w0rd returns the string unchanged, because every substitute is a plain ASCII character rather than a styled variant. Styled fonts fold back to letters under the same operation; leet is the transformation that survives it.<\/li>\n
  • The name becomes unspellable aloud.<\/strong> Ambiguous substitutions mean a handle has to be dictated character by character, and 1 has to be described rather than named.<\/li>\n
  • The original purpose no longer holds.<\/strong> Filters are told about leet explicitly, so the substitution that once hid a word now only makes it harder for humans to read.<\/li>\n<\/ul>\n

    None of that rules out a leet handle. It rules out treating leet as protection, which is the one use in circulation where the cost is invisible until something goes wrong.<\/p>\n

    Where is leetspeak still used?<\/h2>\n

    Yes, people still use it, in three places. It survives in gamer handles and clan tags, where it signals the era as much as the skill. It survives as in-jokes and shorthand, where 1337 and n00b have outlived the writing style they came from. And it survives on password forms, where a required digit or symbol is easiest to satisfy by swapping a letter.<\/p>\n

    Two of those three are harmless habits. The third is the one the counts above argue against, and the fix is not a different substitution but a longer secret, which is the recommendation Specops Software makes in the same article: length before complexity, at fifteen characters or more.<\/p>\n

    Frequently asked questions<\/h2>\n

    Four short questions recur, and each answer follows from the tables above.<\/p>\n

    What does 2 mean in leetspeak?<\/h3>\n

    It usually stands in for the letter z, and in leet vocabulary it sometimes carries the word to.<\/p>\n

    What letter is 9 in leetspeak?<\/h3>\n

    It stands in for g, on the strength of the shape, and it belongs to the wider substitution maps rather than the basic one.<\/p>\n

    Is 1337 the same as leet?<\/h3>\n

    Yes, 1337 is the word leet written in its own alphabet, and both are short for elite.<\/p>\n

    Does a leetspeak generator decode as well as encode?<\/h3>\n

    Ours converts in one direction only, and the ambiguous substitutions described above are the reason a reliable decoder is harder to build than an encoder.<\/p>\n

    Leetspeak is a public table with a small reach: 6 letters of 26 at its basic level, 54 spellings for one common word, and under 6 bits of unpredictability for the password that word becomes. It is a good joke and a bad lock.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Leetspeak is a substitution alphabet: letters are replaced by digits and punctuation that resemble them, so elite becomes leet and leet becomes 1337. Every page that explains it publishes the same table and none of them counts anything, so two questions go unanswered. The first is how much of the alphabet a leet map actually […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-359","post","type-post","status-publish","format-standard","hentry","category-text-formatting"],"_links":{"self":[{"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/posts\/359","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/comments?post=359"}],"version-history":[{"count":1,"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/posts\/359\/revisions"}],"predecessor-version":[{"id":360,"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/posts\/359\/revisions\/360"}],"wp:attachment":[{"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/media?parent=359"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/categories?post=359"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/texttoolz.com\/blog\/wp-json\/wp\/v2\/tags?post=359"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}