{"id":13845978,"url":"https://github.com/shmuelamar/cracken","last_synced_at":"2025-04-04T20:09:48.390Z","repository":{"id":49380958,"uuid":"192120020","full_name":"shmuelamar/cracken","owner":"shmuelamar","description":"a fast password wordlist generator, Smartlist creation and password hybrid-mask analysis tool written in pure safe Rust","archived":false,"fork":false,"pushed_at":"2021-11-22T11:51:19.000Z","size":11762,"stargazers_count":347,"open_issues_count":0,"forks_count":26,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-03-28T19:08:00.838Z","etag":null,"topics":["cracking","hashes","password","password-analysis","pentest-tool","pentesting","rust","wordlist","wordlist-generator"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shmuelamar.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-06-15T20:13:20.000Z","updated_at":"2025-03-09T16:09:25.000Z","dependencies_parsed_at":"2022-09-26T20:31:07.855Z","dependency_job_id":null,"html_url":"https://github.com/shmuelamar/cracken","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shmuelamar%2Fcracken","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shmuelamar%2Fcracken/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shmuelamar%2Fcracken/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shmuelamar%2Fcracken/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shmuelamar","download_url":"https://codeload.github.com/shmuelamar/cracken/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247242678,"owners_count":20907134,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cracking","hashes","password","password-analysis","pentest-tool","pentesting","rust","wordlist","wordlist-generator"],"created_at":"2024-08-04T17:04:14.729Z","updated_at":"2025-04-04T20:09:48.371Z","avatar_url":"https://github.com/shmuelamar.png","language":"Rust","funding_links":[],"categories":["Rust","Uncategorized"],"sub_categories":["Uncategorized"],"readme":"# Cracken\n[![cracken crate](https://img.shields.io/crates/v/cracken)](https://crates.io/crates/cracken)\n[![cracken version](https://img.shields.io/crates/l/cracken)](https://crates.io/crates/cracken)\n[![cracken documentation](https://img.shields.io/docsrs/cracken)](https://docs.rs/cracken)\n[![cracken total downloads](https://img.shields.io/crates/d/cracken)](https://crates.io/crates/cracken)\n\nCracken is a fast password wordlist generator, Smartlist creation and password hybrid-mask analysis tool\nwritten in pure safe Rust (more on [talk/][talk]). Inspired by great tools like [maskprocessor][mp], [hashcat][hashcat], [Crunch][crunch] and 🤗 HuggingFace's [tokenizers][tokenizers].\n\n## What? Why? Woot??\n\nAt [DeepSec2021][talk-abstract] we presented a new method for analysing passwords as Hybrid-Masks exploiting common substrings in passwords by utilizing NLP tokenizers (more info on [talk/][talk]).\n\nOur method splits a password into its subwords instead of just a characters mask. `HelloWorld123!` splitted into `['Hello', 'World', '123!']` as these three subwords are very common in other passwords.\n\n### Hybrid Masks \u0026 Smartlists\n\n* 📄 **Smartlists** - Compact \u0026 representative subword lists created from passwords by utilizing NLP tokenizers\n* 🎭 **Hybrid-Mask** - A representation of a password as a combination of wordlists \u0026 characters (e.g. `?w1?w2?l?d`)\n\n#### Analyzing RockYou Passwords with Smartlists \u0026 Hybrid-Masks:\n\n![Top25 Hybrid Masks from RockYou](./talk/top25_rockyou_hybrid-masks_count.png)\n\nfull table [here](./talk/rockyou_hybrid-masks_counts.csv)\n\n\n### Cracken 🐙 is used for:\n* ✅ Generating **`Hybrid-Masks`** very VERY FAST 🦸⚡💨 (see [performance](#performance) section)\n* ✅ Building **`Smartlists`** - compact \u0026 representative list of subwords from given passwords files (using 🤗 HuggingFace's [tokenizers][tokenizers])\n* ✅ Analyzing passwords for their `Hybrid-Masks` - building statistics for better password candidates (again very fast)\n\n\n### Possible workflows with Cracken:\n\n#### Simple:\n1. Generate wordlist candidates from a hybrid mask - e.g. `cracken -w rockyou.txt -w 100-most-common.txt '?w1?w2?d?d?d?d?s'`\n2. You can pipe the passwords Cracken generates into `hashcat`, `john` or your favorite password cracker\n\n\n#### Advanced:\n1. Create a Smartlist from existing passwords - `cracken create`\n2. Analyze a passwords list of plaintext passwords - `cracken entropy`\n3. use most frequent `Hybrid-Masks` to generate password candidates fast - `cracken generate -i hybrid-masks.txt`\n\nFor more details see [Usage](#usage-info) section\n\n\n## Getting Started\n\n**download (linux only currently):** [latest release 🔗][releases]\n\n*for more installation options see `installation` section*\n\n**run Cracken:**\n\ngenerate all words of length 8 starting with uppercase followed by 6 lowercase chars and then a digit:\n\n```bash\n$ cracken -o pwdz.lst '?u?l?l?l?l?l?l?d'\n```\n\ngenerate words from two wordlists with year suffix (1000-2999) `\u003cfirstname\u003e\u003clastname\u003e\u003cyear\u003e`\n\n```bash\n$ cracken --wordlist firstnames.txt --wordlist lastnames.lst --charset '12' '?w1?w2?1?d?d?d'\n```\n\ncreate a Smartlist of size 50k from subwords extracted from rockyou.txt\n\n```bash\n$ cracken create -f rockyou.txt -m 50000 --smartlist smart.lst\n```\n\nestimate the entropy of hybrid mask of the password HelloWorld123! using a smartlist\n\n```bash\n$ cracken entropy -f smart.lst 'HelloWorld123!'\n\nhybrid-min-split: [\"hello\", \"world1\", \"2\", \"3\", \"!\"]\nhybrid-mask: ?w1?w1?d?d?s\nhybrid-min-entropy: 42.73\n--\ncharset-mask: ?l?l?l?l?l?l?l?l?l?l?d?d?d?s\ncharset-mask-entropy: 61.97\n```\n\n## Performance\n\nAs of writing this, Cracken is probably the world's fastest wordlist generator:\n\n![bechmarks results](./benchmarks/bench-results.svg)\n\nCracken has around 25% increased performance over hashcat's fast [maskprocessor][mp] thats written in C.\n\nCracken can generate around 2 GB/s per core.\n\nmore details on [benchmarks/ 🔗](./benchmarks/README.md)\n\nWhy speed is important? A typical GPU can test billions passwords per second depending on the password hash function.\nWhen the wordlist generator produces fewer words per second than the cracking tool can handle - the cracking speed will degrade.\n\n### Hybrid-Masks Analysis Performance\n\nCracken uses `A*` algorithm to analyze passwords very fast. it can find the minimal Hybrid-Mask of passwords file at rate of **~100k Passwords/sec** (`cracken entropy -f words1.txt -f words2.txt ... -p pwds.txt`)\n\n\n## Installation\n\ninstall Cracken or compile from source\n\n\n### Download Binary (Linux Only Currently)\n\ndownload latest release from [releases 🔗][releases]\n\n### Build From Source (All Platforms)\n\nCracken is written in Rust and needs rustc to get compiled. Cracken should support all Platforms that Rust support.\n\ninstallation instructions for [cargo 🔗][rustc-installation]\n\nthere are two options building from source - installing with cargo from crates.io (preferred) or compiling manually from source.\n\n\n#### 1. install from crates.io (preferred)\n\n**install with cargo:**\n\n```bash\n$ cargo install cracken\n```\n\n#### 2. build from source\n\n\n**clone Cracken:**\n\n```bash\n$ git clone https://github.com/shmuelamar/cracken\n```\n\n**build Cracken:**\n\n```bash\n$ cd cracken\n$ cargo build --release\n```\n\n**run it:**\n\n```bash\n$ ./target/release/cracken --help\n```\n\n\n## Usage Info\n\n\n```\n$ cracken --help\nCracken v1.0.0 - a fast password wordlist generator \n\nUSAGE:\n    cracken [SUBCOMMAND]\n\nFLAGS:\n    -h, --help       Prints help information\n    -V, --version    Prints version information\n\nSUBCOMMANDS:\n    generate    (default) - Generates newline separated words according to given mask and wordlist files\n    create      Create a new smartlist from input file(s)\n    entropy     \n                Computes the estimated entropy of password or password file.\n                The entropy of a password is the log2(len(keyspace)) of the password.\n                \n                There are two types of keyspace size estimations:\n                  * mask - keyspace of each char (digit=10, lowercase=26...).\n                  * hybrid - finding minimal split into subwords and charsets.\n\n\nFor specific subcommand help run: cracken \u003csubcommand\u003e --help\n\n\nExample Usage:\n\n  ## Generate Subcommand Examples:\n\n  # all digits from 00000000 to 99999999\n  cracken ?d?d?d?d?d?d?d?d\n\n  # all digits from 0 to 99999999\n  cracken -m 1 ?d?d?d?d?d?d?d?d\n\n  # words with pwd prefix - pwd0000 to pwd9999\n  cracken pwd?d?d?d?d\n\n  # all passwords of length 8 starting with upper then 6 lowers then digit\n  cracken ?u?l?l?l?l?l?l?d\n\n  # same as above, write output to pwds.txt instead of stdout\n  cracken -o pwds.txt ?u?l?l?l?l?l?l?d\n\n  # custom charset - all hex values\n  cracken -c 0123456789abcdef '?1?1?1?1'\n\n  # 4 custom charsets - the order determines the id of the charset\n  cracken -c 01 -c ab -c de -c ef '?1?2?3?4'\n\n  # 4 lowercase chars with years 2000-2019 suffix\n  cracken -c 01 '?l?l?l?l20?1?d'\n\n  # starts with firstname from wordlist followed by 4 digits\n  cracken -w firstnames.txt '?w1?d?d?d?d'\n\n  # starts with firstname from wordlist with lastname from wordlist ending with symbol\n  cracken -w firstnames.txt -w lastnames.txt -c '!@#$' '?w1?w2?1'\n\n  # repeating wordlists multiple times and combining charsets\n  cracken -w verbs.txt -w nouns.txt '?w1?w2?w1?w2?w2?d?d?d'\n\n\n  ## Create Smartlists Subcommand Examples:\n\n  # create smartlist from single file into smart.txt\n  cracken create -f rockyou.txt --smartlist smart.txt\n\n  # create smartlist from multiple files with multiple tokenization algorithms\n  cracken create -t bpe -t unigram -t wordpiece -f rockyou.txt -f passwords.txt -f wikipedia.txt --smartlist smart.txt\n\n  # create smartlist with minimum subword length of 3 and max numbers-only subwords of size 6\n  cracken create -f rockyou.txt --min-word-len 3 --numbers-max-size 6 --smartlist smart.txt\n\n\n  ## Entropy Subcommand Examples:\n\n  # estimating entropy of a password\n  cracken entropy --smartlist vocab.txt 'helloworld123!'\n\n  # estimating entropy of a passwords file with a charset mask entropy (default is hybrid)\n  cracken entropy --smartlist vocab.txt -t charset -p passwords.txt\n\n  # estimating the entropy of a passwords file\n  cracken entropy --smartlist vocab.txt -p passwords.txt\n\ncracken-v1.0.0 linux-x86_64 compiler: rustc 1.56.1 (59eed8a2a 2021-11-01)\nmore info at: https://github.com/shmuelamar/cracken\n```\n\n### Generate Subcommand Usage Info\n\n```\n$ cracken generate --help\ncracken-generate \n(default) - Generates newline separated words according to given mask and wordlist files\n\nUSAGE:\n    cracken generate [FLAGS] [OPTIONS] \u003cmask\u003e --masks-file \u003cmasks-file\u003e\n\nFLAGS:\n    -h, --help       \n            Prints help information\n\n    -s, --stats      \n            prints the number of words this command will generate and exits\n\n    -V, --version    \n            Prints version information\n\n\nOPTIONS:\n    -c, --custom-charset \u003ccustom-charset\u003e...    \n            custom charset (string of chars). up to 9 custom charsets - ?1 to ?9. use ?1 on the mask for the first charset\n\n    -i, --masks-file \u003cmasks-file\u003e               \n            a file containing masks to generate\n\n    -x, --maxlen \u003cmax-length\u003e                   \n            maximum length of the mask to start from\n\n    -m, --minlen \u003cmin-length\u003e                   \n            minimum length of the mask to start from\n\n    -o, --output-file \u003coutput-file\u003e             \n            output file to write the wordlist to, defaults to stdout\n\n    -w, --wordlist \u003cwordlist\u003e...                \n            filename containing newline (0xA) separated words. note: currently all wordlists loaded to memory\n\n\nARGS:\n    \u003cmask\u003e    \n            the wordlist mask to generate.\n            available masks are:\n                builtin charsets:\n                ?d - digits: \"0123456789\"\n                ?l - lowercase: \"abcdefghijklmnopqrstuvwxyz\"\n                ?u - uppercase: \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\"\n                ?s - symbols: \" !\\\"\\#$%\u0026'()*+,-./:;\u003c=\u003e?@[\\\\]^_`{|}~\"\n                ?a - all characters: ?d + ?l + ?u + ?s\n                ?b - all binary values: (0-255)\n            \n                custom charsets ?1 to ?9:\n                ?1 - first custom charset specified by --charset 'mychars'\n            \n                wordlists ?w1 to ?w9:\n                ?w1 - first wordlist specified by --wordlist 'my-wordlist.txt'\n```\n\n### Create Smartlist Subcommand Usage Info\n\n```\n$ cracken create --help  \ncracken-create \nCreate a new smartlist from input file(s)\n\nUSAGE:\n    cracken create [FLAGS] [OPTIONS] --file \u003cfile\u003e... --smartlist \u003csmartlist\u003e\n\nFLAGS:\n    -h, --help       Prints help information\n    -q, --quiet      disables printing progress bar\n    -V, --version    Prints version information\n\nOPTIONS:\n    -f, --file \u003cfile\u003e...                         input filename, can be specified multiple times for multiple files\n        --min-frequency \u003cmin_frequency\u003e          minimum frequency of a word, relevant only for BPE tokenizer\n    -l, --min-word-len \u003cmin_word_len\u003e            filters words shorter than the specified length\n        --numbers-max-size \u003cnumbers_max_size\u003e    filters numbers (all digits) longer than the specified size\n    -o, --smartlist \u003csmartlist\u003e                  output smartlist filename\n    -t, --tokenizer \u003ctokenizer\u003e...               tokenizer to use, can be specified multiple times.\n                                                 one of: bpe,unigram,wordpiece [default: bpe]  [possible values: bpe, unigram, wordpiece]\n    -m, --vocab-max-size \u003cvocab_max_size\u003e        max vocabulary size\n```\n\n### Entropy Subcommand Usage Info\n\n```\n$ cracken entropy --help\ncracken-entropy \n\nComputes the estimated entropy of password or password file.\nThe entropy of a password is the log2(len(keyspace)) of the password.\n\nThere are two types of keyspace size estimations:\n  * mask - keyspace of each char (digit=10, lowercase=26...).\n  * hybrid - finding minimal split into subwords and charsets.\n\n\nUSAGE:\n    cracken entropy [FLAGS] [OPTIONS] \u003cpassword\u003e --smartlist \u003csmartlist\u003e...\n\nFLAGS:\n    -h, --help       Prints help information\n    -s, --summary    output summary of entropy for password\n    -V, --version    Prints version information\n\nOPTIONS:\n    -t, --mask-type \u003cmask_type\u003e              type of mask to output, one of: charsets(charsets only), hybrid(charsets+wordlists) [possible values: hybrid, charset]\n    -p, --passwords-file \u003cpasswords-file\u003e    newline separated password file to estimate entropy for\n    -f, --smartlist \u003csmartlist\u003e...           smartlist input file to estimate entropy with, a newline separated text file\n\nARGS:\n    \u003cpassword\u003e    password to\n```\n\n## License\n\nCracken is licensed under MIT. **THIS PROJECT MUST BE USED FOR LEGAL PURPOSES ONLY ⚖️**\n\n\n## Contributing\n\nCracken is under active development, if you wish to help below is this the partial roadmap for this project.\nFeel free to submit PRs and open issues.\n\n\n[mp]: https://hashcat.net/wiki/doku.php?id=maskprocessor\n[hashcat]: https://hashcat.net\n[crunch]: https://github.com/crunchsec/crunch\n[releases]: https://github.com/shmuelamar/cracken/releases\n[talk]: ./talk\n[rustc-installation]: https://www.rust-lang.org/tools/install\n[talk-abstract]: https://deepsec.net/speaker.html#PSLOT517\n[tokenizers]: https://github.com/huggingface/tokenizers\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshmuelamar%2Fcracken","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshmuelamar%2Fcracken","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshmuelamar%2Fcracken/lists"}