Tests every entry in one or more password dictionaries against your hash. Effective against passwords that follow common patterns or real-world choices — the majority of weak credentials in the wild.
- Probable-Wordlists — sorted by real-world probability
- Weakpass — large curated public collection
- Our private collection — compiled from real-world breach data
- Your own custom wordlist — upload it to your account and use it directly
Tests every possible combination within a defined keyspace. The two parameters that control it are charset and length — together they determine the number of candidates and the estimated duration.
- Charset — lowercase (a–z), uppercase (A–Z), digits (0–9), symbols, or any combination
- Length — minimum and maximum password length to test
- Keyspace — charset size ^ length — shown before you confirm
- Duration estimate — based on keyspace and algorithm hashrate — shown before payment
A ruleset transforms each wordlist entry into dozens or hundreds of new candidates by applying substitutions, prefixes, suffixes, case changes, and more. It dramatically expands coverage without the cost of a full bruteforce run.
Examples: password → P@ssw0rd, password2024!, PASSWORD.
Rules are applied on-the-fly during the attack — no extra storage needed.
