Need Better Password Cracking - Throw Out the Alphabet

Gorenflo starts from the limits of character-based password guessing. Hashcat masks, wordlists, and rules work well until a password breaks the expected pattern, such as several capitalized words in a passphrase, and then attackers fall back to brute force. He argues that people type passwords in predictable chunks, so the unit being modeled matters more than the model itself.

His tool, tokenov, trains a trigram Markov model on RockYou, but splits passwords into tokens from GPT-2's tokenizer instead of single characters. The talk benchmarks it against John the Ripper, Hashcat, OMEN, and PCFG at fixed candidate budgets. Early CPU-only runs favored tokenov, but he admits the comparison undersold Hashcat's GPU throughput. Under time-boxed tests with best66 and enterprise-style filters (8+ characters, three of four character classes), tokenov came out ahead. He also notes that a much smaller tokenizer trained on password data may work better than the general-purpose one.

He closes with the practical side: a bootstrap command, generation piped into Hashcat, password scoring by rarity bits, seeding from OSINT wordlists, checkpoint resume, and model files that bundle their tokenizer. His takeaway is that character count stops being a reliable strength measure when a long password reduces to a few tokens. Rules help in most cases, except with very slow hashes. The tool is young research, and he invites others to build their own models.