# PassGAN: A Deep Learning Approach for Password Guessing

arXiv: https://arxiv.org/abs/1709.00440 · HTML: https://mlsanity.com/paper/1709.00440/

## Key facts

- Cited by 25 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Sep 2017.

## Built on by (most cited first, 25 of 25)

- [The Threat of Offensive AI to Organizations](https://mlsanity.com/paper/2106.15764/) (2021)
- [Frontier AI's Impact on the Cybersecurity Landscape](https://mlsanity.com/paper/2504.05408/) (2025)
- [EvilModel 2.0: Bringing Neural Network Models into Malware Attacks](https://mlsanity.com/paper/2109.04344/) (2021)
- [Generative Adversarial Networks (GANs) in Networking: A Comprehensive Survey & Evaluation](https://mlsanity.com/paper/2105.04184/) (2021)
- [PassFlow: Guessing Passwords with Generative Flows](https://mlsanity.com/paper/2105.06165/) (2021)
- [PassGPT: Password Modeling and (Guided) Generation with Large Language Models](https://mlsanity.com/paper/2306.01545/) (2023)
- [A Survey of Large Language Models in Cybersecurity](https://mlsanity.com/paper/2402.16968/) (2024)
- [SE#PCFG: Semantically Enhanced PCFG for Password Analysis and Cracking](https://mlsanity.com/paper/2306.06824/) (2023)
- [FedComm: Federated Learning as a Medium for Covert Communication](https://mlsanity.com/paper/2201.08786/) (2022)
- [TATTOOED: A Robust Deep Neural Network Watermarking Scheme based on Spread-Spectrum Channel Coding](https://mlsanity.com/paper/2202.06091/) (2022)
- [GNPassGAN: Improved Generative Adversarial Networks For Trawling Offline Password Guessing](https://mlsanity.com/paper/2208.06943/) (2022)
- [Do You Trust Your Model? Emerging Malware Threats in the Deep Learning Ecosystem](https://mlsanity.com/paper/2403.03593/) (2024)
- [Catch Me If You GAN: Using Artificial Intelligence for Fake Log Generation](https://mlsanity.com/paper/2112.12006/) (2021)
- [Universal Neural-Cracking-Machines: Self-Configurable Password Models from Auxiliary Data](https://mlsanity.com/paper/2301.07628/) (2023)
- [PagPassGPT: Pattern Guided Password Guessing via Generative Pretrained Transformer](https://mlsanity.com/paper/2404.04886/) (2024)
- [When AI Defeats Password Deception! A Deep Learning Framework to Distinguish Passwords and Honeywords](https://mlsanity.com/paper/2407.16964/) (2024)
- [Leveraging AI to optimize website structure discovery during Penetration Testing](https://mlsanity.com/paper/2101.07223/) (2021)
- [On Deep Learning in Password Guessing, a Survey](https://mlsanity.com/paper/2208.10413/) (2022)
- [PassTSL: Modeling Human-Created Passwords through Two-Stage Learning](https://mlsanity.com/paper/2407.14145/) (2024)
- [LLM-Guided Prompt Evolution for Password Guessing](https://mlsanity.com/paper/2604.12601/) (2026)
- [A novel non-linear transformation based multi-user identification algorithm for fixed text keystroke behavioral dynamics](https://mlsanity.com/paper/2210.02505/) (2022)
- [MAYA: Addressing Inconsistencies in Generative Password Guessing through a Unified Benchmark](https://mlsanity.com/paper/2504.16651/) (2025)
- [When Intelligence Fails: An Empirical Study on Why LLMs Struggle with Password Cracking](https://mlsanity.com/paper/2510.17884/) (2025)
- [Multilingual AI-Driven Password Strength Estimation with Similarity-Based Detection](https://mlsanity.com/paper/2603.10217/) (2026)
- [PassGPT+: Leveraging Linguistic Priors for Password Modeling](https://mlsanity.com/paper/2609.39880/) (2026)

## Abstract (arXiv)

State-of-the-art password guessing tools, such as HashCat and John the Ripper, enable users to check billions of passwords per second against password hashes. In addition to performing straightforward dictionary attacks, these tools can expand password dictionaries using password generation rules, such as concatenation of words (e.g., "password123456") and leet speak (e.g., "password" becomes "p4s5w0rd"). Although these rules work well in practice, expanding them to model further passwords is a laborious task that requires specialized expertise. To address this issue, in this paper we introduce PassGAN, a novel approach that replaces human-generated password rules with theory-grounded machine learning algorithms. Instead of relying on manual password analysis, PassGAN uses a Generative Adversarial Network (GAN) to autonomously learn the distribution of real passwords from actual password leaks, and to generate high-quality password guesses. Our experiments show that this approach is very promising. When we evaluated PassGAN on two large password datasets, we were able to surpass rule-based and state-of-the-art machine learning password guessing tools. However, in contrast with the other tools, PassGAN achieved this result without any a-priori knowledge on passwords or common password structures. Additionally, when we combined the output of PassGAN with the output of HashCat, we were able to match 51%-73% more passwords than with HashCat alone. This is remarkable, because it shows that PassGAN can autonomously extract a considerable number of password properties that current state-of-the art rules do not encode.