PassGPT+: Leveraging Linguistic Priors for Password Modeling

1. Introduction

• Passwords remain widely used despite alternatives, and leaked datasets reveal weak, predictable choices that can help attackers compromise accounts.The paper frames password modeling as relevant to both security and understanding user choices.Source: §1 · p. 2
• Hand-crafted guessing rules can generate matches efficiently, but their coverage is limited by the scope of the rules and the expertise needed to extend them.The paper situates learned password models as an alternative to these rule-based tools.Source: §1 · p. 2
• PassGAN learns password distributions with an IWGAN without prior password-structure knowledge, but has low sample uniqueness and lacks explicit probability estimates.PassGPT instead models character-wise conditional probabilities and supports constrained generation.Source: §1 · pp. 2–3
• Both PassGAN and PassGPT learn from password data from random initialization, leaving linguistic structures and semantic rules that people use when creating passwords underexplored.The authors identify generalization beyond training datasets as a concern.Source: §1 · p. 3
• PassGPT+ adapts pretrained GPT-2 weights to password observations, testing whether a foundation-model prior captures regularities in human-chosen passwords.The paper also compares seven approaches and analyzes match rates, password uniqueness, and training choices.Source: §1 · pp. 3–4
• PassDiffusion introduces an absorbing-state discrete diffusion model for password generation, probing whether a non-autoregressive approach can model passwords.The proposed PassGPT+ architecture adapts a GPT-2 decoder using character-aware tokenization.Source: §1 · p. 4

2. Experimental setup

• The evaluation compares seven approaches: Hashcat, PassGAN, PassGAN*, PassVQT, PassDiffusion, PassGPT, and PassGPT+.They span a rule-based tool and multiple learned password-generation models.Source: §2 · pp. 4–5

2.1. Datasets

• After filtering RockYou to passwords of at most 10 characters, the corpus contains about 11.9 million entries and is split 80/20 into training and test sets.The resulting sets contain 9,519,331 training passwords and 2,381,822 unique test passwords.Source: §2.1 · p. 5
• The test set excludes passwords appearing in training, providing a non-overlapping held-out benchmark for model evaluation.The dataset is shuffled before splitting.Source: §2.1 · p. 5

2020 leaked password dataset (cross-distribution evaluation). The RockYou

• The 2020 evaluation samples 2,381,844 passwords of at most 10 characters after removing every password present in RockYou, and tests PassGPT+ without retraining.The matched test-set size enables direct comparison with the RockYou benchmark.Source: 2020 leaked password dataset… · pp. 5–6

2.2. Model architectures

• The study compares three developed password generators against four other approaches, ranging from a rule-based tool to deep generative models.Source: §2.2 · p. 6

2.2.1. Hashcat (rule-based baseline)

• Hashcat supplies a rule-based baseline by applying hand-crafted transformations such as dictionary attacks, leet substitutions, word concatenation, and case toggling.Its unique generated passwords are evaluated using the same match-rate metric as the learned models.Source: §2.2.1 · p. 6

2.2.2. PassGPT+

• PassGPT+ fine-tunes pretrained GPT-2 on passwords instead of training a GPT-2-style model from scratch, leveraging sequential patterns learned from web text.The model uses character-level tokenization, mapping each ASCII character to a GPT-2 BPE token ID.Source: §2.2.2 · pp. 6–7
• PassGPT+ differs from PassGPT by initializing from pre-trained GPT-2 weights rather than an uninformative character-sequence prior, using the full 12-layer, 117M-parameter model instead of its 8-layer variant, and adapting for 3 update epochs rather than 1.Source: §2.2.2 · p. 8
• PassGPT+ generation starts from a randomly sampled character seen at the start of training sequences, then proceeds autoregressively with temperature 1.0 and top-k 50.Generation stops at EOS or 11 tokens.Source: §2.2.2 · p. 8

2.2.3. PassDiffusion (discrete diffusion model)

• PassDiffusion applies absorbing-state discrete diffusion to character-level passwords, with a bidirectional Transformer denoiser trained from scratch to predict clean passwords from masked sequences.Generation starts fully masked and uses reverse unmasking over 200 steps.Source: §2.2.3 · pp. 8–9

2.3. Evaluation metric

• Match rate measures the fraction of real human-chosen passwords in the unique test set that a model can recover; it is reported at 104, 105, 106, 107, and 108 generated passwords.Source: §2.3 · p. 10

3.1. Comparison with existing password guessing approaches

• At 105 guesses, Hashcat’s 0.0918% match rate slightly exceeds PassGPT+’s 0.0847%, but PassGPT+ overtakes it from 106 guesses onward.PassGPT+’s relative gain over PassGPT decreases from about 56.0% at 106 guesses to 16.3% at 108 guesses.Source: §3.1 · pp. 10–12
• At 108 guesses, PassGPT+ reaches a 22.53% match rate versus PassGPT’s 19.37%, and wins at every generation size of 106 or larger.Table 2 compares match rates across generation sizes; Figure 2 also reports the comparison across models.Source: Table 2 · p. 11, §3.1 · p. 11, Figure 2 · p. 12

3.2. Performance of PassDiffusion

• PassDiffusion’s match rate is two to three orders of magnitude lower than PassGPT+’s across the tested generation sizes.The authors attribute the gap in part to exact-match sensitivity and errors accumulating during repeated denoising.Source: §3.2 · p. 13

3.3. Robustness on a newer leaked dataset

• On the newer, disjoint 2020 leak, PassGPT+ retention never falls below 50% and trends upward as the number of guesses increases.Retention is defined as the 2020 match rate divided by the RockYou match rate at the same generation size; the authors report that the relative distribution gap shrinks with more guesses.Source: §3.3 · pp. 13–14

4. Discussion

• PassGPT+ outperforms the main learning-based baselines at medium and large generation sizes and surpasses Hashcat once the guess space is deeper.The authors interpret its improvement over PassGPT as a measurable benefit from an informed linguistic prior beyond reusing GPT-2.Source: §4 · p. 14
• PassDiffusion performs poorly, suggesting iterative denoising is poorly matched to the precise character-level prediction required for password guessing.The authors frame this negative result as evidence that model-task alignment matters.Source: §4 · p. 14
• 17.72% of passwords in the 2020 test set are recovered by PassGPT+ at 108 guesses, with retention above 50% that increases with generation size.Figure 3 compares RockYou and 2020 match rates and defines retention as their ratio at the same generation size.Source: §4 · p. 15, Figure 3 · p. 15

5. Limitations

• Match rates come from single runs without confidence intervals, so smaller-generation-size comparisons would benefit from repeated runs.The authors judge ranking changes from random variation unlikely at 107–108 guesses, where absolute gaps are large.Source: §5 · p. 16
• PassGPT+ changes initialization, model depth, and training epochs together, so their individual contributions are not isolated.The authors note that a controlled ablation would better attribute the gain to transfer learning, but is computationally expensive.Source: §5 · p. 16
• The PassDiffusion result covers one from-scratch absorbing-state D3PM configuration with a 5.3M-parameter encoder.Alternative noise schedules, larger backbones, or pretraining might partially close the gap with autoregressive models.Source: §5 · p. 16
• Evaluation is limited to passwords of at most 10 characters and two leaks, leaving longer passwords and non-English distributions untested.Source: §5 · p. 16

6. Broader impacts

• Accurate password-strength estimators can support password meters, proactive blocklists, and credential-auditing pipelines that flag weak passwords before leaks.Source: §6 · p. 16
• A model trained on one historical leak can retain meaningful effectiveness against modern password distributions, increasing the urgency of moving away from password-only authentication.Source: §6 · pp. 16–17
• The authors acknowledge that improved password models could aid hash cracking, and mitigate risk by using public datasets, evaluating plaintext leaks, and licensing code for defensive auditing.Source: §6 · p. 17

CRediT authorship contribution statement

• Anand led methodology, software, investigation, and the original draft; Lakshmanan handled data curation and validation; Yari supervised and reviewed the manuscript.Source: CRediT authorship contribution statement · p. 17

• The research received no specific grant from public, commercial, or not-for-profit funding agencies.Source: Funding · p. 17

• PassGPT+ uses the HuggingFace transformers library with the GPT-2 checkpoint, while PassDiffusion is implemented from scratch in PyTorch following the absorbing-state D3PM formulation.Source: Reproducibility details · pp. 20–21
• Experiments use publicly available RockYou and 2020 ignis-10M datasets, and the text says the model mappings, training, and generation procedures are described for reproduction.Source: Reproducibility details · p. 20
• The 80/20 train/test split uses a fixed random seed, and test passwords appearing in training are removed.Source: Reproducibility details · p. 21
• Match rates are computed by sampling unique passwords up to a target generation size and intersecting them with the test set; code is planned for release upon acceptance.Source: Reproducibility details · p. 21