{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/passgan-a-deep-learning-approach-for-password","title":"PassGAN: A Deep Learning Approach for Password Guessing","arxiv_id":"1709.00440","date":"2017-09-01","proceeding":null,"authors":["Briland Hitaj","Paolo Gasti","Giuseppe Ateniese","Fernando Perez-Cruz"],"abstract":"State-of-the-art password guessing tools, such as HashCat and John the\nRipper, enable users to check billions of passwords per second against password\nhashes. In addition to performing straightforward dictionary attacks, these\ntools can expand password dictionaries using password generation rules, such as\nconcatenation of words (e.g., \"password123456\") and leet speak (e.g.,\n\"password\" becomes \"p4s5w0rd\"). Although these rules work well in practice,\nexpanding them to model further passwords is a laborious task that requires\nspecialized expertise. To address this issue, in this paper we introduce\nPassGAN, a novel approach that replaces human-generated password rules with\ntheory-grounded machine learning algorithms. Instead of relying on manual\npassword analysis, PassGAN uses a Generative Adversarial Network (GAN) to\nautonomously learn the distribution of real passwords from actual password\nleaks, and to generate high-quality password guesses. Our experiments show that\nthis approach is very promising. When we evaluated PassGAN on two large\npassword datasets, we were able to surpass rule-based and state-of-the-art\nmachine learning password guessing tools. However, in contrast with the other\ntools, PassGAN achieved this result without any a-priori knowledge on passwords\nor common password structures. Additionally, when we combined the output of\nPassGAN with the output of HashCat, we were able to match 51%-73% more\npasswords than with HashCat alone. This is remarkable, because it shows that\nPassGAN can autonomously extract a considerable number of password properties\nthat current state-of-the art rules do not encode.","url_abs":"http://arxiv.org/abs/1709.00440v3","url_pdf":"http://arxiv.org/pdf/1709.00440v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"passgan-a-deep-learning-approach-for-password","repo_url":"https://github.com/achen04/passwordcracking","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":null},{"paper_slug":"passgan-a-deep-learning-approach-for-password","repo_url":"https://github.com/pasquini-dario/PLR","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":null}],"tasks":[{"task_slug":"machine-learning","task_name":"BIG-bench Machine Learning"},{"task_slug":"deep-learning","task_name":"Deep Learning"},{"task_slug":null,"task_name":"Generative Adversarial Network"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}