Can AI crack passwords? How AI changes password guessing

AI cannot simply decrypt passwords. It can, however, learn which passwords people are likely to choose and help prioritise the guesses an attacker tries first.

That is the main difference from pure brute force. Instead of treating every possible character combination equally, specialised models can learn from large password leaks which words, numbers, sequences and modifications appear most frequently.

For a long, truly random and unique password, the search space remains enormous. For human-generated passwords, reused patterns or slightly modified variants, guess ordering can make a significant difference.

This article explains how password attacks work, what AI actually improves, what research such as PassGPT and Pass2Edit demonstrates and which defensive measures remain effective.

Known credential or unknown password?

Not every successful account attack requires guessing a password.

If an email address and password have already been exposed in a breach and the same credentials are reused on another service, an attacker can simply try the known combination there. This is commonly called credential stuffing.

AI is not required for this attack. Password reuse is the vulnerability.

What happens when password hashes are stolen?

Responsible services should not store passwords in plaintext. Instead, they derive a verification value using a password hashing function.

If those values are stolen, an attacker normally cannot reverse the hash directly. They can still test password candidates by deriving the corresponding value and comparing it with the stolen one.

This can happen offline, without sending each guess to the real login service.

Online and offline guessing are different problems

Attack	Where are guesses tested?	Typical limitation
Online	real authentication service	rate limits, lockouts and additional authentication
Offline	attacker-controlled hardware	hashing algorithm, hardware and candidate count

Most research on AI-based password guessing focuses on the offline scenario.

AI improves guess ordering

Password cracking techniques have prioritised human patterns for years. Dictionaries, leaked passwords and rules for common modifications are all used to place likely passwords earlier in the queue.

A generative AI model can learn such patterns directly from large collections of real passwords.

This does not automatically make each password hash faster to compute. It attempts to produce better candidates within the same guessing budget.

PassGPT: a language model for passwords

PassGPT is a GPT-based research model trained specifically on password leaks. It models passwords as character sequences and learns the probability of the next character from the characters that came before it.

In the RockYou experiment, PassGPT recovered 19.37 percent of the held-out test set with 100 million generated guesses. An improved PassGAN approach recovered 9.51 percent.

At one billion guesses, PassGPT reached 41.86 percent, compared with 23.33 percent for the improved PassGAN variant.

Generated candidates	PassGPT	Improved PassGAN
100 million	19.37%	9.51%
1 billion	41.86%	23.33%

These numbers come from a specific experimental setup using RockYou passwords of at most ten characters and should not be interpreted as universal cracking rates for modern accounts.

The paper is available at PassGPT: Password Modeling and (Guided) Generation with Large Language Models.

Password reuse can also mean small modifications

Users often avoid exact password reuse by changing a shared base password. A service name, number, year or character substitution may create a different string while preserving the same personal pattern.

Research shows that these transformations can themselves be predictable.

Pass2Edit: guessing modified passwords

Pass2Edit studies indirect password reuse. The attacker knows one password belonging to a person at service A and tries to guess a different password used by the same person at service B.

Within only 100 guesses, Pass2Edit achieved a 24.2 percent success rate for common users and 11.7 percent for security-savvy users in the evaluated datasets.

The paper is available through USENIX at Pass2Edit: A Multi-Step Generative Model for Guessing Edited Passwords.

Password leaks provide the training material

Large breach corpora contain enormous amounts of information about how people create passwords.

Have I Been Pwned currently lists more than one thousand breached data sets and approximately 17.8 billion affected address records. Its separate Pwned Passwords service contains hundreds of millions of passwords previously exposed in breaches.

The same data can be used defensively to reject passwords that are already known to be compromised.

Password complexity rules are not enough

A password can satisfy formal requirements and still be predictable. A capital letter at the beginning, a number at the end or common character substitutions are exactly the kind of patterns that guessing systems can prioritise.

Current NIST guidance therefore requires passwords used as a single authentication factor to be at least 15 characters long and prohibits additional mandatory composition rules such as requiring a mixture of character classes.

Services must also compare newly selected passwords against blocklists of common, expected or compromised values.

The current guidance is published in NIST SP 800-63B.

Password storage still matters

An attacker’s guessing speed depends heavily on how the service stores passwords.

Fast general-purpose hashes are unsuitable for password storage because they allow very high guessing rates. Dedicated password hashing functions are intentionally expensive in CPU time and memory.

OWASP currently recommends Argon2id for new systems and provides minimum parameter guidance in the Password Storage Cheat Sheet.

What protects against AI-based password guessing?

Use an independent password for every service

A unique password prevents a breach at one service from directly exposing another account and removes the cross-service pattern exploited by password tweaking attacks.

Use a password manager to generate random passwords

A password manager can generate long random passwords that do not need to be memorable. This removes much of the human structure that guessing models attempt to learn.

Use random passphrases when a password must be memorable

A passphrase can be useful when it is generated from randomly selected words. A famous quotation or a phrase personally chosen because it feels memorable is not equivalent to random word selection.

Use multi-factor authentication

A second factor can prevent a compromised password from being sufficient for authentication, although different second-factor technologies provide different levels of phishing resistance.

Passkeys remove many classic password weaknesses

Passkeys replace passwords with asymmetric cryptographic credentials.

The service stores a public key while the corresponding private credential remains with the user’s passkey system. There is no shared password secret for the service to store.

Passkeys are also unique to the relevant service and are designed to be phishing-resistant. The FIDO Alliance describes them as cryptographic credentials that replace reusable passwords.

Can AI predict a truly random password?

An AI model has no special way to predict true randomness.

If every password is generated independently and randomly from a sufficiently large search space, there is no personal template or human pattern for the model to exploit.

The problem therefore moves back toward the large search space that password security is supposed to create.

Conclusion

AI does not make password attacks dangerous by allowing computers to perform an unlimited number of guesses per second. Its advantage is better prioritisation of likely human choices.

PassGPT demonstrates that transformer models can model unseen human passwords more effectively than older generative approaches. Pass2Edit shows that even modified versions of a known personal password can remain predictable.

The defensive response is still straightforward. Passwords should be long, unique and as random as practical. Password managers can generate independent credentials, services should use modern password hashing functions and known compromised passwords should be rejected.

Where passkeys are available, many traditional password-guessing and reuse problems disappear because there is no reusable password secret shared with the service.

The real strength of a password is not how complicated it looks. It is how little an attacker can predict about its structure.