I have an old USB drive encrypted with Truecrypt and can't read my password writing. I can't tell if it's a capital or lower case letter and not sure if it's a 0 or an o, a t or a + on about 7 spaces. I have basic computer knowledge and would really appreciate your help.

Sounds like I need a password generator to put together a wordlist. I'm not sure what would be a good generator that could be told "in this space, it's either a z or a Z and this space it's either a t or a +" etc.

Any advice on how to later implement the wordlist would be greatly appreciated. I don't understand the commands I've seen people write to get the computer to run a command (not sure if that is correct).

  • 1
    Unfortunately, this is not looking like a security question but a request for a tutorial. Most wordlist generators are commandline tools, and we can't walk you through how to use the commandline. Plus there are tons of tutorials out there can do walk a new user through the whole process.
    – schroeder
    Jun 27, 2021 at 8:02
  • 2
    I think "on about 7 spaces" gives the amount of uncertain characters, and that they aren't complete wildcards, but something like I/l/1 or o/O/0. Should be rather easy. For clarity, I would add an example of such password with the uncertain characters. Jun 27, 2021 at 12:42

2 Answers 2


Here is a Bash script (shortened from partialpassword.sh) that reads your password(s) from a file and saves a password list with all the combinations of ambiguous characters, given as extra arguments.

Say your password was MMMMlI1O0t+ and you you have three sets of ambiguous characters:

  • I, l and 1
  • O, o and 0
  • t and +

Try echo "MMMMlI1O0t+" | ./partialpassword.sh - - Il1 Oo0 t+

This will give you a password list with all the 972 (3⁵×2²) possible combinations.

# -----------------------------------------------------------
# Creates a new wordlist from a wordlist by replacing all
# ambiguous characters with all their possible combinations.
# Usage: partialpassword.sh input.txt output.txt O0 [Il1 ...]
# Using "-" as the input reads the passwords from stdin.
# Using "-" as the output prints the wordlist to stdout.
# -----------------------------------------------------------

if [ "$#" -lt 3 ]; then
  printf "\n%s\n" "Usage: $0 input.txt output.txt O0 [Il1 ...]" >&2
  printf "\n%s\n" "Using \"-\" as the input reads the passwords from stdin." >&2
  printf "%s\n" "Using \"-\" as the output prints the wordlist to stdout." >&2
  exit 1

# Read file or stdin.
pwlist=$(cat "$1") || exit 1

for alternatives in "${@:3}"; do

  # First, replace all other characters with the first one.
  for (( i=1; i<${#alternatives}; i++ )); do
      printf "%s" "$pwlist" \
        | sed 's/'${alternatives:$i:1}'/'${alternatives:0:1}'/g'

  # Get max number of characters to be replaced.
    printf "%s" "$pwlist" \
      | sed 's/[^'$alternatives']//g' \
      | awk '{ print length }' \
      | sort -n \
      | tail -n 1

  # Add new combinations.
  for (( i=1; i<${#alternatives}; i++ )); do
    for (( j=1; j<=$max; j++ )); do
      for (( k=$max; k>=j; k-- )); do
          printf "%s" "$pwlist" \
            | sed "s/"${alternatives:0:1}"/"${alternatives:$i:1}/$k""
        pwlist=$(printf "%s\n%s" "$pwlist" "$new" | sort -u)


# Save the file or print the output to stdout.
if [ "$2" = "-" ]; then
  printf "%s\n" "$pwlist"
  printf "%s\n" "$pwlist" > $2 || exit 1
  printf "\n%s\n" "Done."
  • Although very useful, in general, since the OP mentions that they do not know how to use the commandline, they likely do not use Linux, and therefore will not be able to use bash.
    – schroeder
    Jun 28, 2021 at 7:43
  • 1
    Ah, that's what the last sentence means. I may have overestimated the "basic computer knowledge" mentioned earlier. However, this script might be helpful for someone in the future, although the algorithm used doesn't scale up very well. Jun 28, 2021 at 8:01
  • That's why I'm guessing the OP is looking for a basic tutorial. If there are only 7 characters, then the list can be created with a simple script.
    – schroeder
    Jun 28, 2021 at 8:55
  • If you remove the sanity checks from the beginning, this is a rather simple script, too. It's just a bit more generic than writing the loops for fixed set of alternative characters. Jun 28, 2021 at 9:00
  • 1
    How to run this script on Windows: 1) install Git for windows. This will install "Git bash". 2) Download the script named "partialpassword.sh". 3) In the folder where the script is downloaded, create a file named "input.txt" (right click -> new text file) and write your password in it. Save and close. 4) In the folder where the script is downloaded, right click -> select "Git Bash Here". In the window that opens, type ./partialpassword.sh input.txt output.txt Il1 Oo0 t+ 5) The generated wordlist is in the file "output.txt".
    – A. Hersean
    Jun 28, 2021 at 12:25

You could use Hashcat for that:

Assuming your 7 sets are:

  1. o0
  2. t+
  3. zZ
  4. Il
  5. 5S
  6. b8
  7. p:

If your password looks like this ab1de2g345j6k7xyz and you don't know the what I noted as 1..7,


Install hashcat: https://executeatwill.com/2019/02/11/Install-hashcat-on-windows/ The newest version can be found here at time of writing: https://hashcat.net/files/hashcat-


Go on the command line (cmd) and into your hashcat folder

You have 4 sets free to set (https://hashcat.net/wiki/doku.php?id=mask_attack)

So run


hashcat -a 3 -1 0o -2 t+ -3 zZ -4 Il 'ab?1de?2g?3?45jbkpxyz' --stdout >> mywordlist

the other one 5 to 7 set fixed (the used method is known as mask attack mode).

hashcat -a 3 -1 0o -2 t+ -3 zZ -4 Il 'ab?1de?2g?3?45jbkpxyz' --stdout 



and >> appends into a file (here mywordlist)


Change character 7 to the next possible value

hashcat -a 3 -1 0o -2 t+ -3 zZ -4 Il --stdout ab?1de?2g?3?45jbk:xyz >> mywordlist

Then change character 6 and 7

hashcat -a 3 -1 0o -2 t+ -3 zZ -4 Il --stdout ab?1de?2g?3?45j8kpxyz >> mywordlist

and so forth.

You should do this for all possible combinations for example here:









everytime adding to wordlist with >>

Part 4 can also be scripted. For a linux-based system you could use the answer of Esa Jokinen. For Windows batch or powershell can be an alternative.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .