Password‐Model

Password Model

The v3.0 realism engine models how real users actually choose passwords, based on published breach statistics.

Layer 1 — Top-Password Tail

~170 of the most common real-world passwords, frequency-weighted (123456 is ~10× more likely than trustno1!). Roughly 1 in 4 generated passwords comes from this layer — mirroring the real world where the top ~100 passwords cover a surprisingly large share of accounts.

Layer 2 — Weighted Bases

~150 common bases (password, welcome, iloveyou, monkey, team names, cars, pets, keyboard runs...) that humans bolt numbers/symbols onto.

Layer 3 — Generation Patterns (20, weighted)

Pattern	Example
base + full year	monkey1994
base + 2-digit year	welcome94
base + special	dragon!
base + digits	monkey123
first name + year	James1987
name + special + 2-digit year	James@87
first name + digits	Sarah42
initial.last + year	j.smith1987
name + MMYY	James0787
last + initial + year	SmithJ1987
season + year	Summer1987
month + 2-digit year	October87
leet base + year	P@ssw0rd1987
keyboard runs	qwerty, 1qaz2wsx
keyboard run + year	qwerty87
random 8-12 mixed	xK9!mQ2pL

Each pattern carries a weight; the heaviest weights sit on the patterns real breach data shows are most common (base+year, top passwords, base+digits).

Supporting Realism

• Birth years are age-weighted: 55% land in 1975–1995 (the densest account population), 25% in 1996–2005, 20% in 1960–1974.
• Emails use 5 format templates (first.lastNN, firstlastYY, flMMYY, firstlYY, last.firstNN) against per-country weighted domains.
• Dedup on by default — real combolists don't repeat lines.
• --min-length filters for policy-aware candidate lists.

Why Weighted Beats Uniform

A uniform random generator produces mostly "plausible-looking but rare" passwords. Real cracking/spraying wins come from the common tail — the passwords people actually reuse. Weighting reproduces that distribution, which is what makes the output useful for realistic simulations and realistic candidate lists.