Practical PCFG Password Cracking Q&A

In this Password Village Q&A session, researcher Matt Weir answers community questions regarding Probabilistic Context-Free Grammar (PCFG) password cracking and the structural modeling of human-generated passwords [00:00]. Weir explains that while traditional brute-force and Markov-chain tools treat passwords as random byte sequences or character n-grams, PCFG decodes passwords into semantic grammatical structures—such as base structures consisting of alphabetic root words, capitalization patterns, special characters, and numeric digit sequences [04:30].

Weir details how the PCFG trainer parses large public credential dumps to learn replacement probability distributions, allowing cracking engines to prioritize high-probability human mnemonic structures before attempting low-yield combinatorial patterns [09:15]. He compares PCFG performance against modern rule-based engines in Hashcat and John the Ripper, noting that while GPU-accelerated rule evaluation is faster in raw guesses per second, PCFG's superior guess efficiency frequently recovers complex corporate passwords in fewer total attempts [14:40].

The session covers practical guidance on training custom grammars against target-specific password policies and organizational leaks [19:20]. Weir addresses computational overhead, memory management when loading extensive grammars, and strategies for combining PCFG output with GPU-based mask pipelines for maximum effectiveness in red team and audit environments [24:10].

(AI summary — Gemini Flash)