# SE#PCFG: Semantically Enhanced PCFG for Password Analysis and Cracking

arXiv: https://arxiv.org/abs/2306.06824 · HTML: https://mlsanity.com/paper/2306.06824/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 58 references that are in the map.
- First posted on arXiv 12 Jun 2023.

## Builds on (most cited first, 3 of 3)

- [PassGAN: A Deep Learning Approach for Password Guessing](https://mlsanity.com/paper/1709.00440/) (2017)
- [Improving Password Guessing via Representation Learning](https://mlsanity.com/paper/1910.04232/) (2019)
- [Empirical Analysis of Password Reuse and Modification across Online Service](https://mlsanity.com/paper/1706.01939/) (2017)

## Built on by (most cited first, 4 of 4)

- [Rethinking the Privacy of Text Embeddings: A Reproducibility Study of "Text Embeddings Reveal (Almost) As Much As Text"](https://mlsanity.com/paper/2507.07700/) (2025)
- [LLM-Guided Prompt Evolution for Password Guessing](https://mlsanity.com/paper/2604.12601/) (2026)
- [When Intelligence Fails: An Empirical Study on Why LLMs Struggle with Password Cracking](https://mlsanity.com/paper/2510.17884/) (2025)
- [Multilingual AI-Driven Password Strength Estimation with Similarity-Based Detection](https://mlsanity.com/paper/2603.10217/) (2026)

## Abstract (arXiv)

Much research has been done on user-generated textual passwords. Surprisingly, semantic information in such passwords remain under-investigated, with passwords created by English- and/or Chinese-speaking users being more studied with limited semantics. This paper fills this gap by proposing a general framework based on semantically enhanced PCFG (probabilistic context-free grammars) named SE#PCFG. It allowed us to consider 43 types of semantic information, the richest set considered so far, for password analysis. Applying SE#PCFG to 17 large leaked password databases of user speaking four languages (English, Chinese, German and French), we demonstrate its usefulness and report a wide range of new insights about password semantics at different levels such as cross-website password correlations. Furthermore, based on SE#PCFG and a new systematic smoothing method, we proposed the Semantically Enhanced Password Cracking Architecture (SEPCA), and compared its performance against three SOTA (state-of-the-art) benchmarks in terms of the password coverage rate: two other PCFG variants and neural network. Our experimental results showed that SEPCA outperformed all the three benchmarks consistently and significantly across 52 test cases, by up to 21.53%, 52.55% and 7.86%, respectively, at the user-level (with duplicate passwords). At the level of unique passwords, SEPCA also beats the three counterparts by up to 43.83%, 94.11% and 11.16%, respectively.