Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have found during testing that companies often use variations of their names for critical passwords (for example Microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc).

So if I gave it the phrase "stack exchange' it would ideally compute as many logical variations as possible including things like:


I've seen many dictionary generators but they all seem to do something along the lines of


I'm wondering if there are any tools available that will allow me to generate a large number of permutations given a 'starting' word.

share|improve this question
Use the Python Luke! –  Terry Chia Sep 11 '13 at 2:07
@TerryChia yeah, that's my fall-back plan but a pre-existing solution would help greatly :) –  NULLZ Sep 11 '13 at 4:37
Seriously though, is there a need to do this? I thought common password crackers like john already mangle whatever dictionaries you throw at it? –  Terry Chia Sep 11 '13 at 5:03

6 Answers 6

up vote 5 down vote accepted

Try using crunch - wordlist generator.

Usage is:

./crunch <from-len> <to-len> [-f <path to charset.lst> charset-name] [-o wordlist.txt or START] [-t [FIXED]@@@@] [-s startblock]

-t option allows you to specify a pattern, eg: st%ck^%xch%ng%

Where only

  • the @'s will change with lowercase letters
  • the ,'s will change with uppercase letters
  • the %'s will change with numbers
  • the ^'s will change with symbols

Running as following:

./crunch 14 14 -t st%ck^%xch%ng% -o wordlist.txt

gives 330000 results:


You can also modify the charset if you think it's insufficient.

share|improve this answer

Have look through this tool list or this app. No guarantees about malware though, so run downloads through a scanner first.

share|improve this answer
From a quick read all of these programs seem to be specialized in cracking a specific format. Is there a dictionary generator among them that satisfies the OP's request? –  rath Sep 11 '13 at 5:50
It seems that custom apps for this purpose don't get compiled often. If the OP want combinations starting with a specific word; most huge text editors can auto-inject a string at the beginning of each dictionary word. This is usually done by replacing instances of '\n' with '\n[word]'; only the first and last line then need to be manually edited. –  LateralFractal Sep 11 '13 at 6:27
Oop. I misread the OP's meaning of starting word. In that case, no - you'd need a custom app or sed command. –  LateralFractal Sep 11 '13 at 6:28
One of the apps of the SecurityExploded list might serve the purpose - HashKracker. The brute force and pattern modes seem to imply the ability to manipulate the dictionary down to one word while trying character permutations. –  LateralFractal Sep 11 '13 at 6:34

I'm not sure about the algorithmic implications (which means there's probably a lot to improve in my solution) but here goes:

Every letter has an alternate spelling. From your example, o would have the array of O,0 (the last one's a zero). Similarly s would get S,5 etc. Even NULL can be replaced with !,1,2,3... etc. Digraphs are also possible where applicable.

So you don't permutate on words, you permutate on letters. I'm not sure if a precompiled ruleset exists but it doesn't matter; the most time-consuming part is typing up the letter permutations. The main loop would be perfectly straightforward.

for($i=0; $i<strlen($word); $i++){
    for($j=0; $j<strlen($perms[$l]); $j++){
    isUpper($l) ? $word[$i]=tolower($l) : $word[$i]=toupper($l);

for some PHP-flavored pseudocode. I chose PHP because associative arrays make it a bit more comfortable. In other words: Writing the tool yourself might be faster than actually searching for one.

share|improve this answer

I just created a tool that will do what you are talking about. It basically takes a word and generates different possible passwords by replace the characters with capital/lowercase letters and common substitutions. Feel free to take a look at it here:


For a target word of stackexchange the potential password gets quite long since it is essentially creating a cartesian product of all possible character substitutions. The call below:

python passgen.py -f stackexchange

Generates a list with 11,943,936 passwords in it as seen below:

share|improve this answer

I have started to create a Qt application to do this. It's designed to be used against a specific user. I created it to satisfy my own need so it's geared up one way but I plan to make it more customisable. You have to compile it yourself at the moment but it's Qt so it will run on most platforms.

It's on Github

You give it the users name company and optionally some extra keywords and it will generate passwords based on them. Its at 0.1 right now and under active development. The code is easy so if it doesn't do exactly what you need it to you can make changes ( and even contribute them back )

enter image description here

share|improve this answer

here you go! i made it few months ago, it's a Python 2.7 script :p hope it'll help

import time
print ("---------------------------------------------------");
print ("Welcome to BruteForce List Generator!");
print ("---------------------------------------------------");
print ("File output can be long, sometimes in x100Mbs!");
print ("so, have patience fgt,");
print (" ");
print ("Press ^C to exit");
print ("---------------------------------------------------");
length=int(raw_input("Enter the maximum of characters: "))
name=raw_input("Enter destination file name with extension (.txt): ")
tic = time.clock()
print ("---------------------------------------------------");
print ("Running, Please Wait!");
print ("---------------------------------------------------");
lista=[0 for x in xrange(length)]
    if lista[x]==len(string)-1:
        for z in xrange(length):
    elif x==length-1:
        for z in xrange(length):
        for z in xrange(length):
        if x>0:
toc = time.clock()
ttn = toc - tic
print ("Done! in "+str(ttn)+" seconds.");
print ("Please check "+str(name)+" in your directory");
print ("---------------------------------------------------");


share|improve this answer

protected by Community Feb 19 at 13:28

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.