Many people base their passwords on some characteristics or properties of their persona, which might not even be included in wordlists used for a dictionary attack.

If one would put research into someone, like getting to know their full name, birthday, name of pets etc., would it be possible and feasible to construct a wordlist based on these properties combined with some common characters?

For example:

{name: John Doe, born: '1 January 1970', marriedTo: Jane}

could result in a wordlist containing:


Does this type of attack have a name, and if it exits is there an algorithm/tool available to generate such a wordlist based on the input of a list of characters?

  • 2
    Yes, that is called password guessing and they are commonly used attacks.
    – user45139
    Oct 19, 2015 at 15:33
  • @Bergueradj Thanks for the term! I can, however, not find anything about automating such an attack based on a list of properties. Does that mean this method is not very popular in practice?
    – TmKVU
    Oct 20, 2015 at 8:21
  • 2
    Welcom on Security SE. You can take a look at tools like WYD and CUP (see a description here for instance), however product recommendation are out-of-scope on this site since they obsolete very quickly. Oct 20, 2015 at 14:57


Browse other questions tagged .