Repository navigation
kwalk
André Henrique edited this page Sep 13, 2026
·
2 revisions
Generate passwords based on physical keyboard adjacency walks.
__ _______ _ _
\ \ / / ____| | | |
\ \ /\ / /| |__ | |__| |
\ \/ \/ / | __| | __ |
\ /\ / | | | | | |
\/ \/ |_| |_| |_|
WordlistXPL-Forge v1.2.0
Author: André Henrique (@mrhenrike)
Unified wordlist generation for pentest & red team
usage: wlf.py kwalk [-h] [--layout LAYOUT] [--min-len MIN_LEN]
[--max-len MAX_LEN] [--max-changes MAX_CHANGES]
[--directions LIST] [--no-shift] [--start-chars CHARS]
[--route START:DIRS] [--route-file FILE] [--list-layouts]
[--limit LIMIT] [-o OUTPUT]
Generate passwords based on physical keyboard adjacency walks.
Supports QWERTY, AZERTY, QWERTZ, Dvorak, and numpad layouts.
Examples:
wlf.py kwalk --min-len 6 --max-len 10
wlf.py kwalk --layout qwerty,numpad --no-shift
wlf.py kwalk --max-changes 2 --start-chars qaz1
wlf.py kwalk --list-layouts
options:
-h, --help show this help message and exit
--layout LAYOUT Comma-separated layout names (default: qwerty)
--min-len MIN_LEN Min walk length (default: 4)
--max-len MAX_LEN Max walk length (default: 10)
--max-changes MAX_CHANGES
Max direction changes per walk (default: 3)
--directions LIST Comma-separated directions: N,S,E,W,NE,NW,SE,SW
--no-shift Exclude shifted layer (uppercase/symbols)
--start-chars CHARS Restrict starting characters
--route START:DIRS Explicit walk route, e.g. q:3467 or q,3467 (0-7 =
N..NW)
--route-file FILE Route file: one 'start dirs' per line (kwprocessor-
style)
--list-layouts List available keyboard layouts
--limit LIMIT Max candidates (0 = unlimited)
-o, --output OUTPUT Output file
| Flag / arg | Default | Required | Description |
|---|---|---|---|
--layout |
'qwerty' | no | Comma-separated layout names (default: qwerty) |
--min-len |
4 | no | Min walk length (default: 4) |
--max-len |
10 | no | Max walk length (default: 10) |
--max-changes |
3 | no | Max direction changes per walk (default: 3) |
--directions |
- | no | Comma-separated directions: N,S,E,W,NE,NW,SE,SW |
--no-shift |
False | no | Exclude shifted layer (uppercase/symbols) |
--start-chars |
- | no | Restrict starting characters |
--route |
- | no | Explicit walk route, e.g. q:3467 or q,3467 (0-7 = N..NW) |
--route-file |
- | no | Route file: one 'start dirs' per line (kwprocessor-style) |
--list-layouts |
False | no | List available keyboard layouts |
--limit |
0 | no | Max candidates (0 = unlimited) |
-o, --output |
- | no | Output file |
- Minimum:
wlf kwalk --help - Typical: see examples in the syntax block.
- Globals:
--min-len,--max-len,--limit,--threadswhen the command generates lists.
Stdout and/or -o / --output when the parser exposes it. Exit 0 on success; non-zero on invalid input.
- Valid: exit 0
- Invalid: timeout
Examples use generic labels (BrandX, acme.example). This repo does not ship wlist_brasil.
WordlistXPL-Forge, member of the XPL-Forge suite. Author: Andre Henrique (mrhenrike) | Uniao Geek | https://uniaogeek.com.br/ | Authorized testing only.