Password models improve by using language knowledge and neural networks
PassGPT+: Leveraging Linguistic Priors for Password Modeling
Cryptography and SecurityMachine Learning
Summary
Passwords are still the main way people log into online accounts, so understanding how people create them helps improve security. The authors show that using a type of language model called GPT-2, which knows how words and letters typically appear, helps predict passwords better than starting from scratch. They also tested a new method that guesses passwords differently, but it didn't work as well. Their results suggest that human passwords have patterns similar to language, which these models can learn and use to guess passwords more accurately.
What this means in practice
- •For security teams: Estimate the strength of user passwords more accurately to improve defense strategies against attacks.
- •For penetration testers: Simulate realistic password guessing attacks that better reflect how users create passwords using linguistic knowledge.
Authors
Rajneesh Anand, Neeraj Lakshmanan, Masoud Yari
Abstract
Passwords remain the dominant online authentication mechanism, and understanding how humans choose them is essential for defensive strength estimation and attack simulation alike. Recent learning-based approaches such as PassGAN and PassGPT have shown that deep generative models can learn password structure directly from leaked corpora. However, both train from random initialization on password data alone. The role of linguistic prior knowledge in password modeling, and what it reveals about how humans create secrets, remains largely underexplored. Here, we address this gap with PassGPT+, which adapts the linguistic prior of GPT-2 to password observations through character-aware tokenization. We also introduce PassDiffusion, the first absorbing-state discrete diffusion model for password generation, as a probe of whether non-autoregressive approaches are competitive. On the RockYou benchmark, PassGPT+ recovers 22.53% of held-out passwords at 108 guesses, a 16% relative gain over PassGPT, and retains 79% of this match rate when transferred without retraining to a disjoint 2020 leak dataset, demonstrating that linguistic priors capture persistent regularities of human password generation. PassDiffusion underperforms by two to three orders of magnitude, indicating that autoregressive modeling is substantially better matched than iterative denoising to the discrete, exact-match nature of password generation.