Every Password Used in the Harry Potter Series

‘Oh don’t mind me! Don’t apologize for bothering me! I’ll just hang here, wide open, until you get back, shall I?’ The Fat Lady says it in Goblet of Fire, and the Harry Potter Lexicon puts the line at the top of her page, which is the right place for it. She is a painting, she guards a door, and she has been asked for a password so many times that she has opinions about the arrangement. Her list of them runs from Percy Weasley’s ‘Caput Draconis’ on Harry’s first night in the castle to a Latin greeting in the sixth book, and it is only the start of what the novels keep locked.

Rowling herself has explained the system, in a note on the Hufflepuff common room published on harrypotter.com. Each house guards its door differently, and ‘the complexity or otherwise of the entrance to the common rooms might be said to give a very rough idea of the intellectual reputation of each house’: Hufflepuff’s portal never changes and wants rhythmic tapping, Slytherin’s and Gryffindor’s ask for a word, and Ravenclaw’s door ‘presents a fresh intellectual or philosophical challenge every time a person knocks on it’. The passwords are not set dressing, in other words. They are a running joke about institutional security, told by an author who noticed that a school run by wizards would still need a bureaucracy, and that the bureaucracy would get to pick the words.

The locks outside the four houses are stranger. The head’s office usually wants the name of a sweet. The prefects’ bathroom wants to be told it smells of pine. The kitchens want a pear tickled, the Ministry wants a telephone number, and a radio programme wants a password before it will let you listen. What follows is every one of them in the seven novels, counted by the key rather than the door: a fixed word, an answer or a gesture that opens one specific thing, with spells left out and the sources’ disagreements left in. The Gryffindor list comes first, in the order the Fat Lady’s own list gives them.

Caput Draconis

Caput Draconis is not just Latin for dragon’s head. It is one of the sixteen figures of geomancy, a divination system that reads fortunes from patterns of dots, and Agrippa’s Of Geomancy, in Robert Turner’s English version of 1655, files it among the earthly figures and says that in the first house it ‘augmenteth life and fortune’. Franz Hartmann’s 1889 manual is blunter: ‘Dragon’s head, entrance, threshold, upper kingdom, is good.’ A threshold figure, which is a lot of thought to put into a word said to a painting.

The Lexicon’s Fat Lady page glosses it simply as Latin for dragon’s head and codes it to Chapter 7 of Philosopher’s Stone, the night of the Sorting, when the new Gryffindors are led up to their dormitories. harrypotter.com reads the omen into the plot: the figure ‘specifically means good fortune with starting or beginning new things’, fitting for Harry’s first day, and the site calls the moment ‘the very first utterance of a Gryffindor password’. The Lexicon’s chapter page offers its own guess, that the prefects picked it to gee up a house that had watched Slytherin take the House Cup six years running, and flags it as a guess. Nobody in the book explains the choice.

The same page adds that the phrase is borrowed from a list of terms used in sikidy, a form of geomancy from Madagascar. The dragon’s head had travelled a long way to reach a portrait hole.

Pig snout

Wizarding World’s Chapter Challenge for ‘The Midnight Duel’ offers readers three house points for making up a password for their own household and being ‘as strict as the Fat Lady’ about it, the highest bounty on the page. The official site is also unusually forthcoming about the chapter’s real password: ‘In this chapter, the password to the Gryffindor common room is pig snout.’ The Lexicon’s census records the same thing more tersely, as ‘pig snout (PS9)’, and stops there.

Stopping there is the point. No coded sentence anywhere on the Lexicon names who says it or to whom, so pig snout is the first password on the census with no speaker attached, only a chapter. Chapter 9 of Philosopher’s Stone is the one with the flying lesson in which Neville is hurt, Malfoy’s challenge to a midnight duel, and the wrong turn that puts Harry, Ron, Hermione and Neville in the forbidden corridor on the third floor, in front of the thing it was forbidden for. A great deal happens in that chapter. The password is not one of the things anyone remembers from it.

Merriam-Webster defines a snout as ‘a long projecting nose (as of a swine)’, which means the password is, precisely, a pig’s nose. After caput draconis this is a comedown. It is also the first sign of what the Fat Lady’s list will become: a run of words that sound like someone opening a dictionary at random and stabbing.

Wattlebird

Australia has a bird called the wattlebird, and it is a noisy one. Merriam-Webster has it as ‘any of several Australasian honeyeaters (genus Anthochaera) having ear wattles’, first attested in English in 1819, and the Australian Museum describes the red wattlebird as ‘a large, noisy honeyeater’ whose range runs across the southern part of the mainland. Why the Fat Lady should have wanted one as a password is not a question the record answers.

The Lexicon’s census codes wattlebird to Chapter 5 of Chamber of Secrets, and that chapter is not a quiet one. It is ‘The Whomping Willow’, the flight of Harry and Ron to school in a flying Ford Anglia, ending in the crash into the tree on 1 September 1992. The password sits in the census as a bare entry, with no speaker, no gloss and no note of any kind, and the chapter page itself never mentions the word. It is the only Chamber of Secrets password the Fat Lady’s census carries.

harrypotter.com’s fact file for the common room states the mechanism the bird served, and nothing more: the room ‘was accessible with a password given to the portrait of The Fat Lady’. That is the whole of the official record. Of the sixteen words on her census, wattlebird has the least to say for itself and the most interesting thing to look up afterwards, which describes a good deal of her list.

Fortuna Major

Agrippa’s treatise on geomancy, as Turner Englished it in 1655, says of one figure that ‘being found in the first House’ it ‘giveth long life, and freeth from the molestation of Diseases’. The figure is Fortuna major, which the geomancers assigned to the Sun and which Franz Hartmann, in 1889, summed up as ‘Great Fortune, success, interior aid and protection, is a very good sign’. Princeton’s page on medieval geomancy rates Greater Fortune simply ‘Very good’. The Fat Lady’s census settles for ‘Latin for better luck’.

It is the second geomantic figure on her list after caput draconis, and it arrives the same way, in Percy Weasley’s mouth: ‘The new password’s Fortuna Major!’ is among the memorable lines the Lexicon picks out of Chapter 5 of Prisoner of Azkaban. The rest of that chapter is not lucky at all. It is ‘The Dementor’, the journey on which Dementors board the Hogwarts Express hunting Sirius Black, Harry faints, and Remus Lupin, newly hired to teach Defence Against the Dark Arts, makes his first appearance. Better luck was a reasonable thing to wish for.

One thing the scene does not contain is singing. The Fat Lady’s Lexicon page states that ‘there is nothing in canon to identify the Fat Lady with an opera singer’, and that the portrait trying to shatter a wineglass with her voice belongs to the film alone. In the book the password is announced, and the chapter moves on.

Scurvy cur

Sir Cadogan got the job because nobody else would take it. After Sirius Black slashed the Fat Lady’s canvas in Chapter 8 of Prisoner of Azkaban a replacement was needed for the portrait hole, and the Lexicon’s page on him records that he ‘was the only painting brave enough to take the job’. What Gryffindor got was a knight who ‘thought up ridiculous passwords and changed them on a daily basis’.

Scurvy cur is the first of two the Fat Lady’s census credits to him by name, coded to Chapter 11, the chapter of the Firebolt. It is real English. Merriam-Webster gives scurvy as ‘arousing disgust or scorn: contemptible, despicable’ and cur as ‘a mongrel or inferior dog’, or figuratively ‘a surly or cowardly fellow’. It is how Cadogan talks to everyone. ‘Stand and fight, you mangy cur!’ he shouts in Chapter 9, and harrypotter.com’s tour of the castle’s portraits quotes him roaring ‘Braggarts and rogues, dogs and scoundrels, drive them out, Harry Potter, see them off!’

He never let the word go. Two years later, in Order of the Phoenix, the Lexicon notes him challenging Harry to ‘stand and fight, you scurvy cur’ and giving chase through a neighbouring painting, where a large and angry-looking wolfhound stops him. The Lexicon’s etymology note adds that his name is pronounced ka-DOG-an. A knight named for a dog, calling everyone a mongrel, and destined to be talked past by Sirius Black, whose Animagus form is a dog.

Oddsbodikins

The second password Sir Cadogan set was a swear word, once. Merriam-Webster files oddsbodikins under the spelling odsbodikins as ‘archaic – a mild oath’, with the etymology ‘probably euphemism for God’s bodykins’: one of the minced oaths people used so as not to swear by the body of God out loud. The Fat Lady’s census records it as ‘Sir Cadogan thought this one up too’, coded to Chapter 12 of Prisoner of Azkaban, ‘The Patronus’.

Given his habits it was probably not his second in the tower, and that rate of change is the story. The Lexicon says Neville Longbottom ‘confused him with so many passwords that he made a list so he would remember them’; Wizarding World’s feature on the Fat Lady’s passwords puts it the other way round: ‘Only Neville would write down all of the Fat Lady’s passwords on a piece of parchment and leave it lying around.’

Sirius Black found it. In Chapter 13 he used the list to talk his way past Cadogan into Gryffindor Tower, where he threatened Ron and Scabbers with a knife. The chapter page preserves the question asked afterwards: ‘Which person ... which abysmally foolish person wrote down this week’s passwords and left them lying around?’ McGonagall fired Cadogan. Neville lost his Hogsmeade visits, got a detention, was banned from being told any password at all, and got a Howler from his grandmother. His offence was forgetting a word whose entire meaning is a polite way of not saying God.

Flibbertigibbet

‘This is the foul fiend Flibbertigibbet. He begins at curfew and walks till the first cock.’ Edgar says it in King Lear, Act 3, Scene 4, disguised as Poor Tom. The word itself is older and sillier: etymonline dates it to the 1540s as ‘chattering gossip, flighty woman’, probably a nonsense word meant to sound like fast talking, and puts the devil sense at around 1600.

The Lexicon’s note on the Fat Lady’s census keeps both senses in play. ‘The most common modern meaning of this word is “an irresponsible, silly person,” but a much rarer meaning implies that the person is a mischief-maker if not actually a fiend’, and it suggests the password ‘perhaps refers to Neville Longbottom who kept leaving passwords lying about’. The census codes it to Chapter 15 of Prisoner of Azkaban, ‘The Quidditch Final’, in which Hagrid loses Buckbeak’s case, Hermione slaps Draco Malfoy, and Gryffindor wins the Cup.

One thing it is not is a Sir Cadogan password. He was sacked in Chapter 14, and the Fat Lady was back on the wall by this one, whose Lexicon page cross-links the Gryffindor common room and no knight at all. Merriam-Webster notes that the fiendish sense resurfaced when Walter Scott gave the name to an impish urchin in Kenilworth, more than 200 years after Lear, then faded for good. It had one more revival, on a castle wall, aimed, if the Lexicon’s guess is right, at a boy who could not keep a secret.

Balderdash

Before it meant nonsense, balderdash was a drink. etymonline traces the word to the 1590s, ‘of obscure origin despite much 19c. conjecture’, and says that in early use it meant ‘a jumbled mix of liquors’, milk and beer or beer and wine, and only by the 1670s a ‘senseless jumble of words’. Merriam-Webster now defines it in one word, nonsense. The Fat Lady’s census gives it no gloss at all, which is fair, since it needs none.

What the census does give it is two chapter codes, GF12 and GF14, the only entry on her list attached to more than one chapter, and both chapter pages cross-link the Fat Lady and Gryffindor Tower. Chapter 12 of Goblet of Fire is ‘The Triwizard Tournament’, the storm-soaked start of fourth year in which Mad-Eye Moody arrives to teach and Dumbledore announces the tournament; Chapter 14 is ‘The Unforgivable Curses’, the lesson in which the man teaching as Moody demonstrates them. The password outlasted at least that much.

harrypotter.com preserves the exchange that gives the word its best moment. The Fat Lady’s friend Violet has just brought her the gossip. ‘Well, well, well,’ says the Fat Lady, ‘Violet’s just told me everything. Who’s just been chosen as school champion, then?’ ‘Balderdash,’ says Harry, dully. ‘It most certainly isn’t!’ says Violet, offended, until the Fat Lady explains that it is only the password, and swings open. Harry gave the password and Violet heard an opinion. For once, both readings were available.

Fairy lights

In Britain, fairy lights are what Americans call string lights. The Cambridge Dictionary has them as ‘small electric lights on a string used as decoration, especially on trees at Christmas’, and Hogwarts, being British, has them too: harrypotter.com’s account of the Yule Ball describes the grounds ‘transformed into a grotto-like space with fairy lights and real live fairies in the rose bushes’. The Fat Lady’s census puts the password in Chapter 22 of Goblet of Fire, ‘The Unexpected Task’, the chapter in which the Ball is announced and Harry asks Cho Chang, who is already going with Cedric Diggory, and ends up taking Parvati Patil.

The Lexicon’s separate entry for fairy lights files the term one chapter later, at the Ball itself, and explains why it is a pun: Flitwick decorates his classroom with Christmas lights that turn out to be ‘real, live fairies’. Where the Lexicon’s pages disagree, the chapters here follow its Fat Lady census, which pairs each password with the chapter it was set in. Either way the password belongs to the run-up to Christmas, well before the Tournament’s Second Task in Chapter 26.

It is the first of the Fat Lady’s seasonal passwords. harrypotter.com, comparing a Muggle Christmas with a wizarding one, concedes the point on the school’s behalf: ‘our humble fairy lights will always pale in comparison to the Hogwarts Great Hall during Christmas time’. The Fat Lady, hanging outside it, had the better view.

Banana fritters

Fritter is a fourteenth-century word. etymonline traces it to Old French friture, ‘fritter, pancake, something fried’, and behind that to the Late Latin frictura, ‘a frying’; Merriam-Webster’s modern definition is ‘a small mass of fried or sautéed batter often containing fruit or meat’. The combination with a banana arrived at the Gryffindor portrait hole in Chapter 25 of Goblet of Fire, ‘The Egg and the Eye’, where the census lists it bare, with neither a speaker nor a note.

harrypotter.com’s guided tour of the Hogwarts portraits is warmer about it. The Fat Lady, the official site says, was ‘always equipped with top-notch passwords such as “banana fritters”, “baubles” and (after some festive over-indulgence) “abstinence”’, which puts the fritters at the head of a small run of passwords about eating and drinking. Nobody in either source eats one. The chapter page’s cross-links tie the password to the chapter, and that is the extent of the connection.

The chapter itself is busy elsewhere: Harry working out the golden egg’s clue, Barty Crouch’s name appearing on the Marauder’s Map, a trick step on a staircase, and Mad-Eye Moody steering Harry clear of Snape and borrowing the Map for his trouble. Chapter 26 is ‘The Second Task’, which fixes the password’s place in the year well enough. Banana fritters guarded Gryffindor Tower in the chapter before it.

Mimbulus mimbletonia

Neville Longbottom brought it to school on the train. ‘Mimbulus mimbletonia,’ he said proudly, in Chapter 10 of Order of the Phoenix, showing off a present from his Great Uncle Algie, who had found it in Assyria, and moments later it ‘spewed Stinksap all over the railway carriage and onto Harry and Luna’, which Ginny cleaned up with a Scouring Charm. A chapter later the plant’s name was the Gryffindor password. The Lexicon’s entry codes it to Chapter 11, ‘The Sorting Hat’s New Song’, and harrypotter.com’s fact file adds the obvious joke: it was ‘one of the only passwords Neville had no trouble remembering’.

There is no such plant. The Lexicon’s chapter page says so plainly, and adds that ‘there is a variety called the Mimulus’. Merriam-Webster confirms that mimulus is a real genus of American herbs, the monkey flowers, named from the Late Latin mimus, ‘comic actor’, ‘probably from the resemblance of the flower bud to a mask’. The Lexicon’s etymology note goes one step further into the strange: in the flower-remedy lore developed by Dr Edward Bach in the 1920s, an essence of mimulus ‘is said to counter anxiety and fear’. A remedy for nerves, named for a mask, given to the most nervous boy in the house.

The Lexicon also notes that the name ‘sounds a bit like the incantation for the Tongue-Tying Spell, “Mimble wimble”’, and concludes there is no connection. By Chapter 38 the plant made ‘odd crooning noises’ when stroked. Neville kept it.

Dilligrout

At the coronation of Charles II in 1661, Thomas Leigh ‘made a mess of pottage called Diligrout and brought it to the king at his table’, in the words of the Victoria County History of Surrey. That was his rent: the lords of the manor of Addington held their land by presenting a dish to the monarch on coronation day, and the record runs a long way back: a 1377 entry recognised by John of Gaunt calls it ‘a dish of gruel called Dillegrout or Malepigernout’, and the earliest name for it, in a record of services under Henry III, is maupigernoun. The Lexicon’s census gloss, quoting the New Shorter Oxford, agrees: a stew or porridge ‘offered to the British monarch on coronation day by the lord of the manor of Addington, Surrey’.

The Fat Lady asked for it in Chapter 12 of Half-Blood Prince, ‘Silver and Opals’, the Hogsmeade weekend on which Katie Bell is cursed by a necklace. The Lexicon’s dish entry adds a second chapter; the census, which this list follows, gives one. It is the only password on her list with a place in English constitutional history, a strange thing to say about gruel.

Charles II accepted the service and, the county history notes, ‘did not taste of it’. The dish went on being carried in through James II, Anne and the Georges; the last was served at George IV’s banquet in 1821. A painting in a castle found one more use for the word.

Baubles

A bauble was a jester’s sceptre before it was a Christmas decoration. Merriam-Webster’s older sense of the word is ‘a scepter of a fool’, and it dates the first known use to the fourteenth century, from the Middle English babel by way of Middle French. The Lexicon’s own entry settles for the modern meaning, ‘a shiny ball hung on a Christmas tree as decoration’, and that is plainly the sense the Fat Lady had in mind, because the census attaches it to Chapter 15 of Half-Blood Prince, ‘The Unbreakable Vow’, which the Lexicon’s calendar places on 19 and 20 December 1996, the last two days before the Christmas break.

The Lexicon’s Baubles entry adds a second chapter, 17, and calls the password one used ‘around the holidays’. The census gives Chapter 15 alone, and this list follows the census, because Chapter 17 is where it records a different password entirely, the one the Fat Lady set after the holidays had got the better of her. Baubles is the before. harrypotter.com lists it between banana fritters and abstinence, and the order tells the story.

The word gets around the castle. The Lexicon’s entry tracks Dobby hanging a bauble on his tea cosy one Christmas, a string of golden baubles bearing Harry’s face in the Room of Requirement the next Christmas, and glowing baubles lighting St Mungo’s over the holidays in place of its usual crystal orbs. Gryffindor Tower got the plain version: one word, in a castle full of tinsel.

Abstinence

Hermione explains this one, and the Lexicon quotes her twice. The page for Chapter 17 of Half-Blood Prince, ‘A Sluggish Memory’, opens with her line ‘It was the Fat Lady who drank a vat of five-hundred-year-old wine, Harry, not me’, and the entry for Violet, the Fat Lady’s friend, carries the rest: ‘She and her friend Violet drank their way through all the wine in that picture of drunk monks down by the Charms corridor.’ The census calls it the ‘post-Christmas holidays password’ and gives the same reason.

It was not a first offence. The Fat Lady’s own Lexicon page records that one earlier Christmas the two of them ‘got a bit tipsy on chocolate liqueurs’, and the Violet page notes that ‘both Violet and The Fat Lady have a weakness for alcohol at Christmas’. Violet herself hangs in the antechamber off the Great Hall and answers to Vi. harrypotter.com, with official tact, calls the whole episode ‘some festive over-indulgence’.

The Lexicon’s calendar puts the chapter on 5 and 6 January, the first days back after New Year. Merriam-Webster defines abstinence as ‘the practice of not doing or having something that is wanted or enjoyable’. The Fat Lady set it as a password having just done the opposite, which is the only kind of resolution most people make in January.

Tapeworm

‘Come back! All right, I lied! I was annoyed you woke me up! The password’s still “tapeworm”!’ The Lexicon’s page for Chapter 23 of Half-Blood Prince preserves the Fat Lady’s outburst among its notes, and draws the institutional conclusion: ‘Apparently the Fat Lady can deny entry into the Common Room even if a person knows the password.’ A lock that knows the key and refuses it anyway, out of pique. Nothing else on this list is recorded doing that.

The census codes tapeworm to that chapter and attaches no gloss, unlike dilligrout and quid agis, which get short italic notes. It needs none. Merriam-Webster defines the tapeworms as flatworms ‘that are parasitic as adults in the intestines of vertebrates including humans’, and its entry runs to a single dense clinical sentence about a scolex, suckers and a chain of proglottids. Nothing about it is seasonal, which after fairy lights, baubles and abstinence is a change of register.

The chapter is ‘Horcruxes’, dated by the Lexicon’s calendar to Monday 21 April, the night Harry races to Dumbledore’s office with Slughorn’s true memory. Together they watch Tom Riddle ask about Horcruxes, and Dumbledore sets out his suspicion that Voldemort made six Horcruxes. The page’s epigraph is Slughorn’s horror: ‘Seven! Isn’t it bad enough to think of killing one person?’ The password guarding the tower that night was a parasite. Nobody in the sources remarks on the fit.

Quid agis

Cicero used it on the floor of the Senate. ‘M. Tulli, quid agis?’ appears in his First Oration Against Catiline, and Lewis and Short’s Latin dictionary, in the Perseus Digital Library’s edition, glosses the phrase as colloquial for ‘what are you doing?’ The Fat Lady’s census renders it ‘Latin for “How do you do?”’, which is the polite English equivalent, and codes it to Chapter 24 of Half-Blood Prince. The chapter is ‘Sectumsempra’, in which Harry sees Draco Malfoy crying on the Marauder’s Map, follows him into a bathroom, and strikes him with a curse he knows nothing about, which slashes Malfoy open. Snape heals him and gives Harry detention for the rest of the year. The password is a greeting. The chapter is not.

The chapter page’s epigraph is Snape’s question about Harry’s Potions book: ‘Then why [...] does it have the name “Roonil Wazlib” written inside the front cover?’ It is also the last Gryffindor password on the Fat Lady’s list. The census, which runs from caput draconis in Chapter 7 of the first book to this, stops here. No later Gryffindor password is recorded anywhere on the Lexicon.

What comes after is not a password at all. The Fat Lady’s page records that when Dumbledore died ‘she allowed Harry into the common room without requiring a password, but wailed when he told her it was true’. Sixteen words, from a dragon’s head to how-do-you-do, and then, for one night, none.

Sherbet lemon (UK editions) / Lemon drop (US editions)

‘Would you care for a sherbet lemon?’ Dumbledore asks McGonagall on Privet Drive in the first chapter of the first book. ‘A what?’ ‘A sherbet lemon. They’re a kind of Muggle sweet I’m rather fond of.’ Both the Lexicon and harrypotter.com quote the exchange, and the Lexicon’s sweet entry defines it with some heat: ‘A hard lemon-flavoured candy shell filled with effervescent sherbet powder... Not the same thing as Lemonheads or lemon drops!’ The Oxford Companion to Sugar and Sweets calls the powder ‘essentially a U.K. specialty’. The same Lexicon entry then notes that the US edition replaced ‘sherbet lemon’ with ‘lemon drop’. Hence two names for one password.

It opens the head’s office in Chamber of Secrets, when Harry is hauled before Dumbledore. The Lexicon’s own pages split on the chapter: its office list and its tower page code the gargoyle scene to Chapter 11, while its note that McGonagall knew the password, and the chapter summaries themselves, put the visit in Chapter 12. This list files it there. The Lexicon’s hedge on the whole lock deserves quoting: ‘Dumbledore’s password for the gargoyle always seems to have been the name of a sweet, and to have been known to the various staff members though not to the student body at large.’

The password seems to have been staff knowledge, the sort of thing every professor who taught at Hogwarts might be told and no pupil would. Harry heard it from a teacher and rode the moving staircase up.

Cockroach Cluster

Ron had a plan for Fred. ‘Reckon Fred’d take a bit of Cockroach Cluster if I told him they were peanuts?’ he asks in Honeydukes, in Prisoner of Azkaban, where the Lexicon places the sweet ‘next to the blood-flavored lollipops in the far corner of the shop marked “Unusual Tastes”’. The motive, per the Lexicon, was an Acid Pop Fred had once given him. harrypotter.com’s ranking of the wizarding world’s sweets puts Cockroach Clusters fourteenth of fifteen and declines to soften it: ‘The clue is very much in the title here. Cockroach Clusters, clusters of cockroaches.’

A year later it was the password to the head’s office. The office’s known-passwords list codes it to Chapter 29 of Goblet of Fire, ‘The Dream’, in which Harry falls asleep in Divination, dreams of Voldemort, and goes straight to Dumbledore to report it.

The visit the cockroach cluster opened ends a chapter later with Harry face down in a stone basin, the way into every memory viewed in the Pensieve. Chapter 30 takes its title from the object, and the Lexicon quotes Dumbledore’s explanation from that scene: ‘One simply siphons the excess thoughts from one’s mind, pours them into the basin, and examines them at one’s leisure.’ A password made of cockroaches let Harry into the most important object in the room. Nobody planned it that way. That is how the office works.

Toffee Eclairs

The Lexicon cannot decide which door this one opens. Its dedicated entry says, in full, ‘Password to Dumbledore’s office (HBP20)’, and its entry on eclairs agrees word for word: ‘“Toffee eclairs” was a password to Dumbledore’s office (HBP20).’ Its entry on dilligrout, a page about a stew, lists ‘toffee eclairs (HBP20)’ among the passwords used for Gryffindor Tower in Harry’s sixth year. Two dedicated pages against one aside, so the office it is, with the hedge attached: the string appears on neither the Fat Lady’s census of Gryffindor passwords nor the office’s own list of known ones. It has a chapter and no fixed address.

Chapter 20 of Half-Blood Prince, ‘Lord Voldemort’s Request’, does not settle it, because the chapter has scenes at both. Ginny Weasley fights with Dean Thomas and Ron breaks up with Lavender Brown in the tower; in the office, Harry and Dumbledore watch Tom Riddle visit Hepzibah Smith and see Slytherin’s locket, then ask Dumbledore for the Defence Against the Dark Arts post. The chapter page cross-links both locations, and leaves it there.

The sweet itself is plain enough. Merriam-Webster defines toffee as ‘candy of brittle but tender texture made by boiling sugar and butter together’, and an eclair as a pastry filled with cream; the Lexicon’s Eclairs page files the toffee kind beside the chocolate ones. Note the spelling: the Lexicon prints it without an accent, and so does this list, on the principle that you print what the coded source prints.

Acid Pops

harrypotter.com ranks the wizarding world’s sweets and puts Acid Pops last, fifteenth of fifteen, ‘based on the fact that Ron said one once “burnt a hole right through” his tongue as a child’. The ranking adds: ‘We’re good, thanks!’ The Lexicon carries the original line, coded to the Honeydukes visit in Chapter 10 of Prisoner of Azkaban: ‘Fred gave me one of those when I was seven – it burnt a hole right through my tongue. I remember Mum walloping him with her broomstick.’ A hole, note; the coded wording is precise.

By Harry’s sixth year the sweet was the head’s office password. The office list codes it to Chapters 9 and 10 of Half-Blood Prince, and the sweet’s own entry says Acid Pops ‘was also the password to Dumbledore’s study for a time during Harry’s sixth year’. Chapter 9 is Harry’s first day of classes, the one in which he wins the Felix Felicis with the Half-Blood Prince’s annotated book; Chapter 10 is his first private lesson with Dumbledore, the Pensieve trip to the Gaunt house. harrypotter.com’s feature on Dumbledore lists Acid Pops with sherbet lemons as passwords to the office, so the string is on the official record as well as the Lexicon’s.

Merriam-Webster’s relevant sense of acid is ‘sour, sharp, or biting to the taste’, which makes the name a mild exaggeration of the real British acid drop. Ron, who had the evidence on his tongue, might dispute the word mild.

Fizzing Whizbee

Spelling is the first problem. The Lexicon’s known-passwords list for the head’s office prints ‘Fizzing Whizbee (OP22)’, singular, one z, and that is how this list prints it. The Lexicon’s own page for the sweet is headed ‘Fizzing Whizzbees’, two z’s, plural, and harrypotter.com spells it the same way on its sweets ranking, where the Whizzbees come seventh of fifteen and are credited with ‘an enjoyable name to say out loud’. The same ranking calls them ‘levitating sherbet balls’ that ‘once featured as one of Dumbledore’s many passwords to his office’.

Ron describes the sweet in Prisoner of Azkaban: ‘massive sherbet balls that make you levitate a few inches off the ground’. The Cambridge Dictionary supplies the British sense of sherbet the name relies on, ‘an artificial powder with a fruit flavour eaten as a sweet or used to make a drink, especially for children’, not the frozen dessert an American reader will picture.

The password belongs to Chapter 22 of Order of the Phoenix, the St Mungo’s chapter, the night Arthur Weasley is attacked and Dumbledore sends Harry and the Weasley children to Grimmauld Place. The Lexicon codes two office details to that chapter: candlelight after dark, and that the portraits of former Heads ‘can visit their portraits in other wizarding institutions and locations and deliver messages, act as lookouts, and so on’. The gargoyle asked for a sherbet ball, and the paintings went to work.

Pure-blood

There is exactly one Slytherin password on record, and it has no chapter. harrypotter.com’s survey of the four common rooms says that ‘the Slytherin one was hidden behind a bare stretch of wall and accessible once the correct password was given (one such password was pure-blood)’, and that parenthesis is the whole of the evidence. No page on the Lexicon pairs the word password with the phrase. It occurs zero times on the Slytherin Common Room entry, zero on the Slytherin House entry, and zero on the Lexicon’s own Pure-Blood entry, which runs long on blood status and never mentions a door.

The string is on this list because the lock is. What the sources do describe, with codes, is the room. ‘The light is green from the green hanging lamps and because it’s located under the lake,’ the Lexicon says, coding it to Chamber of Secrets and to Chapter 23 of Deathly Hallows; there are high-backed chairs, a carved mantelpiece and rough stone walls. The official fact file adds dark chairs, leather sofas and the tint the lake gives the whole room.

One of an unknown number, then, with no book attached and no scene, from a house whose entrance Rowling herself described as ‘almost imperceptible’. Merriam-Webster, asked about the real phrase, redirects to ‘full-blooded’ and offers ‘of unmixed ancestry: purebred’. The Slytherins chose a password that was also a policy.

The Ravenclaw knocker’s riddles, and their answers

‘What? Isn’t there just a password?’ Harry asks, and Luna Lovegood tells him no: ‘Oh, no, you’ve got to answer a question.’ harrypotter.com quotes the scene. Ravenclaw Tower has a bronze eagle knocker, and the Lexicon records the first riddle with its chapter: ‘Which came first, the phoenix or the flame?’, put to Harry and Luna in Chapter 29 of Deathly Hallows. Luna’s answer, in the official site’s extract, is ‘Well then, I think the answer is that a circle has no beginning’, and the voice replies ‘Well reasoned’.

The second riddle comes a chapter later, and the sources disagree. The knocker’s own Lexicon page codes it to Chapter 29 as well; the Chapter 30 page narrates the scene, quotes the riddle, and summarises it as ‘Professor McGonagall and Amycus Carrow enter the Ravenclaw Common Room’, while the Chapter 29 page never mentions either of them. So Chapter 30 it is. ‘Where do Vanished objects go?’ asks the knocker, and McGonagall answers, ‘Into non-being, which is to say, everything.’ The Lexicon’s quotation page carries the line, hyphen and all, coded to Chapter 30. Amycus spits in McGonagall’s face; Harry attacks him. The Lexicon’s timeline files the scene as a prelude to the battle, not part of it.

Two riddles, two answers, one mechanism, so one entry. The Lexicon’s remark on the second is a shrug: since Vanishing Spells are fifth-year Transfiguration, ‘it’s not surprising that McGonagall could answer this easily’. Amycus Carrow had presumably skipped that year.

Pine fresh

Cedric Diggory gave Harry directions the Lexicon calls ‘extremely clear’: ‘fourth door to the left of the statue of Boris the Bewildered on the fifth floor’, followed by the password, quoted and coded to Chapter 23 of Goblet of Fire: ‘Password’s “pine fresh.”’ There is nobody to say it to: the Lexicon’s bathroom entry notes that no portrait or statue guards the entrance and ‘apparently the door itself recognizes the password’. It bolts from the inside, which, given the wall’s ‘rather flirtatious picture of a mermaid in a golden frame’, seems wise.

The Lexicon codes the fittings to Chapter 25: a tub ‘the size and depth of a swimming pool’, a diving board, and taps along the rim, each with a differently coloured jewel in the handle and a different bubble bath behind it. harrypotter.com’s fact file agrees on the gold taps, the coloured water and the mermaid, and records the room’s one notable event: the golden egg’s clue, solved. The chapter is ‘The Egg and the Eye’; the eye, the Lexicon explains, is Moody’s.

He was not alone. The chapter summary says Harry ‘is helped by Moaning Myrtle’, her own entry codes the spying to the same scene, and harrypotter.com lists her with the prefects among the room’s regular visitors. Of every Hogwarts ghost in the novels, she is the one who keeps turning up in bathrooms. Her earlier offer to Harry, in Chamber of Secrets, had been to share her toilet with him if he died.

I solemnly swear that I am up to no good / Mischief managed

‘Moony, Wormtail, Padfoot, and Prongs. We owe them so much.’ George Weasley says it in the Prisoner of Azkaban chapter in which he and Fred give Harry the Marauder’s Map, and the Lexicon files the sentence that opens the thing as an incantation: ‘I solemnly swear that I am up to no good’ is the ‘Incantation which opens the Marauders Map’. Fred supplies the closer in the same scene: ‘Just tap it again and say, “Mischief managed!” And it’ll go blank.’ One object, two phrases, one entry.

The four names are the makers: James Potter, Sirius Black, Remus Lupin and Peter Pettigrew invented the map and its incantations at Hogwarts in the 1970s and wrote their nicknames into it. Three of them had done something harder than cartography. Because Lupin was a werewolf, the Lexicon records, Black, Potter and Pettigrew ‘became Animagi while students at Hogwarts’, and Rowling’s own note on harrypotter.com explains why: so that they ‘could keep him company without harm to themselves’. The map’s authors account for a fair share of every Animagus in the Harry Potter novels, unregistered to a man.

Rowling also records that Filch confiscated the map in its makers’ final year and that none of them got it back. The Weasley twins had it next, and gifted it to Harry ‘unwittingly passing it on to the child of one of the creators’. Fred’s verdict, coded to the same chapter: ‘This little beauty’s taught us more than all the teachers in this school.’

“Open”, in Parseltongue

One word, two locks, three uses. The Lexicon’s Chamber of Secrets entry describes the first: the entrance is a sink in Moaning Myrtle’s bathroom with ‘a tiny snake figure scratched into the tap’, and ‘when someone orders “open up” in Parseltongue, the sink recedes and a pipe appears’. The code is Chapter 16 of Chamber of Secrets, attached to the paragraph rather than the sentence. What waits below is a basilisk, a reptile of legend ‘with fatal breath and glance’ in Merriam-Webster’s words, and Chapter 17 takes place entirely inside the Chamber, where Fawkes and Harry kill it.

The second lock is a locket, ‘a heavy gold locket carrying Salazar Slytherin’s mark’, which Voldemort had turned into a Horcrux. It sits on the roster of every Horcrux Voldemort made, and in Chapter 19 of Deathly Hallows Harry speaks to the thing inside it in Parseltongue, it opens, and Ron destroys it with Gryffindor’s sword.

The third use is the one Harry misses. During the Battle of Hogwarts, the Lexicon records, ‘Ron managed to approximate the sound of the Parseltongue word for “open” and he and Hermione entered the Chamber to recover Basilisk fangs’. Harry is not in the sentence. The official fact file agrees, ‘Hermione and Ron collect Basilisk fangs’, and Rowling, in an interview the Lexicon quotes, called Ron’s version mimicry: ‘he heard him say “Open,” and he was able to reproduce the sound. So it was one word.’ The lock heard the sound, not the speaker.

Tickle the pear

Hermione found or was told about the kitchens; the Lexicon says both. Its page for Chapter 21 of Goblet of Fire, ‘The House-Elf Liberation Front’, summarises that ‘Hermione discovers how to get into the kitchens’, and its entry on the kitchens, coded to the same chapter, says she ‘had found out about the entrance to the kitchen from Fred and George’. Both readings stay, because the source keeps both. What nobody disputes is the door. harrypotter.com’s fact file has it: ‘When tickled, a pear would giggle and turn into a large green door handle, allowing entrance to the kitchens.’ The Lexicon’s kitchens entry says the same.

The official fact file puts the kitchens ‘under the Great Hall, close to the Hufflepuff common room’, behind ‘a large painting of a bowl of fruit’. Merriam-Webster defines a still life as ‘a picture consisting predominantly of inanimate objects’, which this one is not, quite. Inside, in the same chapter, Harry, Ron and Hermione find Dobby and Winky among the house-elves, and the official house-elf fact file records Hermione’s reaction to discovering who did the cooking: shock, followed by a campaign.

It is one of the few entries on this list that is a gesture rather than a word, and much the friendliest. The Lexicon’s kitchens entry adds that after the second task Harry went back down through the same pear to present Dobby with new socks. The door, presumably, giggled again.

Tap the brick wall

Nothing in that courtyard but a dustbin and a few weeds. That is the Lexicon’s coded description of the yard behind the Leaky Cauldron in Chapter 5 of Philosopher’s Stone, where Hagrid leads Harry after the bar: ‘He tapped the wall three times with the point of his umbrella. The brick he had touched quivered – it wriggled – in the middle, a small hole appeared – it grew wider and wider – a second later they were facing an archway large enough even for Hagrid.’ Then: ‘Welcome,’ said Hagrid, ‘to Diagon Alley.’ The Lexicon’s chapter page carries a panel headed ‘Tapping the bricks’: Rowling’s own drawing of how the gateway opens.

It is the earliest-coded lock on this list and the only one opened with an umbrella. The Lexicon’s pub entry places the Leaky Cauldron on Charing Cross Road, ‘tiny’ and ‘grubby-looking’, between a book shop and a record shop, invisible to passing Muggles. Rowling’s own writing on harrypotter.com adds that the pub is ‘believed to have been built some time in the early 1500s’ with the rest of the street, and that its true address is number one, Diagon Alley.

The official fact file lists the pub’s notable events as ‘Harry realises he is famous’ and ‘Harry takes sanctuary after running away from Privet Drive’. The wall does the actual work. Rowling thought it worth drawing, and the Lexicon thought the drawing worth keeping.

6-2-4-4-2

Dial 6-2-4-4-2, state your name and business, and the box sinks. The Lexicon’s visitors’-entrance entry codes the whole procedure to Chapter 7 of Order of the Phoenix: ‘Inside, there is a telephone that hangs crooked against the wall; one needs only to lift the receiver, dial 6-2-4-4-2, state your name and business and then the box will sink down into the Ministry.’ The chapter page adds the joke the number is built on: ‘6-2-4-4-2, spells M-A-G-I-C.’ harrypotter.com says the same from the other direction, that the Ministry ‘can be reached by dialling 62442 (which spells “MAGIC” on an alphanumeric keypad)’.

The entrance is shabby by design. The Lexicon describes ‘an old red telephone box’ in the heart of London, in front of a heavily graffitied wall and missing several panes of glass; harrypotter.com calls it ‘a seemingly innocuous Muggle telephone box’. Square silver badges with the visitor’s name appear in the coin return. Arthur Weasley takes Harry through it on Thursday 12 August 1995, for the disciplinary hearing, and Mr Weasley appears on the official site’s own list of the Ministry’s notable employees, so one of the two people in the box worked there.

No other password on this list is also a phone number, or one a Muggle could, in principle, dial. Merriam-Webster defines a telephone booth as ‘an enclosure within which one may stand or sit while making a telephone call’. This one goes down.

Unlock the front door with a wand

Nobody is recorded saying anything at the door of number twelve, Grimmauld Place. The Lexicon’s house entry, coded to Chapter 4 of Order of the Phoenix, says the front door ‘had spells on the front door such that it could only be unlocked by a wizard using his or her wand’, and the door carries ‘a silver knocker in the shape of a twisted serpent, with no keyholes, handles, or anything else that would indicate it to be a door, as it opens only by magic’. Both sentences are the Lexicon’s paraphrase, not Rowling’s words; no coded sentence names a tap, gesture or incantation, so none appears here. The key is a wand. The word is missing.

It is the odd one out here, and the door was never the house’s real security. The Lexicon codes the rest to Chapter 6: the house is Unplottable, and ‘Dumbledore used the Fidelius Charm to hide number twelve Grimmauld Place, the headquarters of the Order of the Phoenix. He himself was the Secret-Keeper for the Order.’ The charm, per the Lexicon, hides a secret ‘inside a single, living soul’. A door nobody can find needs no lock. harrypotter.com mentions Unplottability and Moody’s ‘many magical security measures’, and no wand.

The Blacks, ‘one of the wizarding world’s oldest pureblood families’, lived there for many years, and the hall is furnished to match, down to an umbrella stand made from the severed leg of a troll that Tonks ‘is particularly prone to knocking over’.

Albus

Ron remembered it months late. The Lexicon’s entry on Potterwatch, the underground radio programme of the last book, states the rule first, coded to Chapter 20 of Deathly Hallows: ‘it was impossible to tune in to the program unless you spoke a password while tapping your wand on your wizarding radio.’ Then it gives the word: ‘The password for the program Harry, Ron and Hermione listened to in March 1998 was “Albus,” which Ron remembered only months after rejoining Harry and Hermione in the Forest of Dean.’ That sentence carries no chapter code of its own. It sits between two coded to Chapter 22, whose page confirms that ‘Ron finally manages to pick up a Potterwatch broadcast’ sometime in March, and the password rests on that.

A password for a broadcast is a different thing from a password for a door, and this list counts both: a fixed word that opens one specific thing. harrypotter.com’s feature on wizarding journalism describes the programme as clandestine, ‘dedicated to spreading word of the fight against Voldemort’, hosted by Lee Jordan, with everyone on air under a code name. The Lexicon gives the aliases without codes: Jordan was River, Kingsley Shacklebolt Royal, Remus Lupin Romulus, and Fred Weasley Rapier, having briefly been Rodent.

The official site compares the operation to the radio network of the French Resistance. The password, meanwhile, was a dead headmaster’s first name. Given the state of Ron’s memory, it was as well that it was a short one.

Mad-Eye

The March broadcast ended by announcing the password for the next one. The Lexicon’s sentence is quoted and coded together: ‘At the end of the March 1998 program, the password for the next program was announced: “Mad-Eye” (DH22).’ That is the strongest evidence any Potterwatch password has, and stronger than Albus, whose sentence carries no code of its own. The chapter page’s notes record what the programme was for: ‘their respect for the fallen, their exhortations to be careful, and their cheerful mockery of the Death Eaters’.

The fallen included the man the password names. The Lexicon’s summary of Chapter 5 of the same book, ‘Fallen Warrior’, ends with Bill and Fleur arriving to ‘break the news that Moody was murdered by Voldemort, while Mundungus fled’. Alastor Moody was already dead when a radio programme chose his nickname as the key to its next episode. The Lexicon’s Potterwatch page also carries a longer list of names under ‘Known passwords’, alphabetical and without a single chapter code. Nothing here rests on it.

Lee Jordan, as River, signed the programme off, and the Lexicon quotes him: ‘We don’t know when it will be possible to broadcast again, but you can be sure we shall be back. Keep twiddling those dials... Keep each other safe. Keep faith. Good night.’ The next password was a dead friend’s name. They were keeping faith.