PassCluster: A New Segmented Password Cracking Model

Passwords remain a widely deployed component of digital authentication because of their low cost and broad compatibility, but users’ weak or reused passwords make them vulnerable to attacks. Advancing password-cracking research is vital to assess password strength and improve cybersecurity. Current password models exhibit biased structural segmentation: Markov models are overly fine-grained, leading to weak contextual dependencies, while PCFG models are too coarse to capture detailed features. Although existing segmentation-based models have to some extent balanced the granularity issue of password processing units, they still lack effective partitioning strategies, leading to suboptimal overall modeling performance. To address this problem, this paper proposes PassCluster, a model that clusters the characters within passwords and segments them based on the clustering results. It then utilizes an LSTM network to model sequential dependencies between segments and learns a left-to-right conditional probability distribution over segment sequences, enabling password generation by sampling segments in order. This approach enables more reasonable password segmentation, allowing the model to generate more accurate password guesses. Extensive experiments on eight real-world datasets demonstrate that the proposed approach improves guessing accuracy by 27.0% and 85.5% in intra-site and cross-site scenarios, respectively. Moreover, under the same number of unique password guesses, PassCluster exhibits strong performance and maintains competitive effectiveness. Furthermore, a real-time Password Strength Meter is developed based on this model to assist users in constructing stronger passwords, underscoring the importance of incorporating fine-grained segmentation and probabilistic modeling in password security evaluation.