Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to crack my own password. Advantage is that I know possible characters and maximum length.

What I need is to create a dictionary. The dictionary should contain all the combos of characters that I choose (for example I don't need word list which contain character T, because I didn't used T in my password).

How can I do that?

share|improve this question
Just a note on terminology, this is a "Dictionary attack", not a "Brute force attack". The more information you know, the better your dictionary can be; likely lengths, patterns such as starts with capital, ends with number, two words joined plus a number, l33t speak, etc. Even if you're not sure about something it can be used to order the dictionary. But don't put the information here or anyone will be able to use it. – Ladadadada Sep 10 '13 at 8:01
1. Can you program? 2. What is the password for, i.e. how will you know when you have found the correct one? – Jan Doggen Sep 10 '13 at 8:20

So you could use python to generate all possible combinations using itertools.permutation

import itertools
res = itertools.permutations('abc',3) # 3 is the length of your result.
for i in res: 
   print ''.join(i)

where 'abc' is a string of possible characters. Note that a and A are not the same!

This will output:


Edit (thanks to @buherator):

If you want repeated letters (e.g. aaa, etc), you need to use itertools.product instead. For instance,

import itertools
res = itertools.product('abc', repeat=3) # 3 is the length of your result.
for i in res: 
    print ''.join(i)

This will output:

share|improve this answer
This won't give you all possible passwords with a given charset (aaa is missing for example). itertools.combinations_with_replacement() can be more useful. – buherator Sep 10 '13 at 10:31
Sorry itertools.combinations_with_replacement() is neither the right choice, you should use itertools.product(). – buherator Sep 10 '13 at 11:08
how will be if I wanna a permutation of numbers?, 000, 001, 002.. – Cristian Chaparro A. Jan 30 '15 at 15:55

Password cracking tools, such as John the Ripper or hashcat, can be used this way. They have various "mangling" rules that will take a dictionary (in your case a one word dictionary) and then apply a number of transformations on it. You can then specify the rules based on the kinds of things you may have done with your password.

Learning how to specify these sorts of rules isn't trivial, and unfortunately you aren't in a position to ask for detailed help without revealing too much about the password.

Here are some sample, annotated, john CONFIGs, which might be of some help:

And here is a list of john tutorials, but I haven't actually looked at any myself, so again, I can only point you in the general direction:

share|improve this answer

You need to use a wordlist to create dictionary attack. You can write your own wordlist generator or use an exisisting one.

Here are some existing wordlist generators:

You can find more. After generating a wordlist, you need to try every combination of those words until you find a matching one with your password.

share|improve this answer

You should use crunch or john the ripper. If you know the length and possible combinations of your password you can make a pretty good dictionary. For example you know your password was something like


or maybe


etc.. you can do

crunch 8 11 pPa@s$wW0oOrd123 -o list.txt

This will make a list with a minimum length of 8 max 11 containing any of the given characters. Note this could be a huge list.

share|improve this answer
crunch is a great tool, but it's Linux [or all the versions I have found]. Has anyone compiled a windows-compatible version? – Alan Campbell Jan 9 '15 at 1:06

You will also need a tool to run through the dictionary.

For a website try:

or generally:

If it is a desktop application using the password for behaviour instead of data confidentiality, you may be able to simply delete setting files or hack its memory while running.

I am assuming you are not a script kiddie ;-)

share|improve this answer

protected by Community Jan 6 at 4:57

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.