294 entries (standalone rulesets + collapsed near-duplicate families) parsed
from rules/
. Descriptions and before→after examples are generated by parsing each
file's hashcat operators and applying its own rules to a sample word. Search, filter by speed,
or sort by rule count.
K
thousand · M
million · B
billion · T
trillion
candidates
Runtime assumes ~55M-word (~550 MB) list @ ~10 GH/s on a fast hash
| #▲ | Ruleset / Family | What it does · with a live example | Best suited for | Rules↕ | Runtime effect | Speed↕ |
|---|---|---|---|---|---|---|
| 1 |
clem9669_large.rule
|
Mostly adds characters to the front (1word, !word…); also tacks symbols onto the end (!, @, #, $…), tacks digits onto the end (years, 1, 123…). e.g. Password1
→ $$Password1!!
, Password1 00
.
|
General human passwords incl. French/accented and emoji — fine for dumps and WPA. Pair with a multilingual or RockYou-style list. | 3,549,930 | ≈195.2T · ~5.4 h | Insane |
| 2 |
huge.rule
|
Mostly inserts characters at specific positions inside the word; also overwrites characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ daPyssword1
, 000000assword1
, =Password10
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 2,140,585 | ≈117.7T · ~3.3 h | Insane |
| 3 |
CakeV2.rule
|
Mostly overwrites characters at specific positions inside the word; also adds characters to the front (1word, !word…), tacks digits onto the end (years, 1, 123…). e.g. Password1
→ tassword1
, 1Password1
, Password10
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 2,111,406 | ≈116.1T · ~3.2 h | Insane |
| 4 |
Fordyv3-2Mil.rule
|
Mostly trims or deletes characters from the word; also overwrites characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Passwordo
, Passwor1d1
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 2,000,000 | ≈110T · ~3.1 h | Insane |
| 5 |
KoreLogicRulesAppend6Num.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends 6 numbers. Mostly tacks digits onto the end (years, 1, 123…); also changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→Password1000000
, Passw0rd0
→Passw0rd0000000
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends 6 numbers). Pair with company names, seasons, months and a base dictionary of leaked founds. | 2,000,000 | ≈110T · ~3.1 h | Insane |
| 6 |
sapphire_v4.rule
|
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ asswor81
, Password11
, Pasasword1
.
|
General human-password mutation for fast-hash dumps; newer versions refine older. Pair with RockYou/weakpass. | 1,760,298 | ≈96.8T · ~2.7 h | Insane |
| 7 |
• generated2-full.rule
• generated3.rule
(family — 2 files) |
Machine-generated rules (hashcat-utils) — randomized stacks of inserts, overwrites and swaps for broad brute-ish coverage. Mostly reshuffles characters or uses positional swap/memory ops; also overwrites characters at specific positions inside the word, reverses, duplicates or reflects the word. e.g. Password1
→ aPassword1.
, aQssw@rd1
, 01drowssPa
. Differences:
members share ~1,454,332 core rules; generated2-full.rule
adds ~156,750 more that reshuffles characters or uses positional swap/memory ops; generated3.rule
adds ~3 more that trims or deletes characters from the word.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 1,454,335–1,611,082 | ≈88.6T · ~2.5 h | Insane |
| 8 |
sapphire_v1.rule
|
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ dassword1
, Password11
, Pasasword1
.
|
General human-password mutation for fast-hash dumps; newer versions refine older. Pair with RockYou/weakpass. | 1,270,145 | ≈69.9T · ~1.9 h | Insane |
| 9 |
KoreLogicRulesAppendNumbers_or_Specials_PrependLetter.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends numbers or special chars prepends letter. Mostly inserts characters at specific positions inside the word; also tacks symbols onto the end (!, @, #, $…), tacks digits onto the end (years, 1, 123…). e.g. Password1
→ QPassword10
, qPassword1!
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends numbers or special chars prepends letter). Pair with company names, seasons, months and a base dictionary of leaked founds. | 1,206,868 | ≈66.4T · ~1.8 h | Insane |
| 10 |
SuperUnicorn.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly inserts characters at specific positions inside the word; also overwrites characters at specific positions inside the word, reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ PWassword1
, dassword1
, Oassword1
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 1,077,833 | ≈59.3T · ~1.6 h | Insane |
| 11 |
Fordyv3-1Mil.rule
|
Mostly trims or deletes characters from the word; also tacks digits onto the end (years, 1, 123…), overwrites characters at specific positions inside the word. e.g. Password1
→ Passwordo
, Passwor1d1
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 1,000,000 | ≈55T · ~1.5 h | Insane |
| 12 |
CakeV1.rule
|
Mostly trims or deletes characters from the word; also overwrites characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Passaord
, Passwordo
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 999,949 | ≈55T · ~1.5 h | Insane |
| 13 |
Robot_CurrentBestRules.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also overwrites characters at specific positions inside the word, inserts characters at specific positions inside the word. e.g. Password1
→ Password1@972
, Passwrd1
, P*1ssword1
.
|
General fast-hash cracking incl. reversed-guess passes. Pair with RockYou or HashMob founds. | 942,680 | ≈51.8T · ~86 min | Insane |
| 14 |
FordyBigBoy.rule
|
Mostly trims or deletes characters from the word; also overwrites characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ wod1
, Passwo++1
, sPas6w
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 886,008 | ≈48.7T · ~81 min | Insane |
| 15 |
sapphire_v3.rule
|
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ Passwor11
, Password12
, Passaword1
.
|
General human-password mutation for fast-hash dumps; newer versions refine older. Pair with RockYou/weakpass. | 750,001 | ≈41.3T · ~69 min | Insane |
| 16 |
nyxgeek-i1o1.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly inserts characters at specific positions inside the word; also overwrites characters at specific positions inside the word. e.g. Password1
→ Paassword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 685,584 | ≈37.7T · ~63 min | Insane |
| 17 |
nyxgeek-i2.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ Paaassword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 685,584 | ≈37.7T · ~63 min | Insane |
| 18 |
nyxgeek-o1i1.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly inserts characters at specific positions inside the word; also overwrites characters at specific positions inside the word. e.g. Password1
→ Paassword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 685,584 | ≈37.7T · ~63 min | Insane |
| 19 |
nyxgeek-o2.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ Pbssword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 685,584 | ≈37.7T · ~63 min | Insane |
| 20 |
Pantacorn.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly inserts characters at specific positions inside the word; also overwrites characters at specific positions inside the word, reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ PWassword1
, dassword1
, Oassword1
.
|
Broad human-password coverage on fast unsalted hashes (NTLM/NTDS, MD5, SHA1); overkill for slow WPA/bcrypt. Pair with RockYou, weakpass or HashMob founds. | 600,000 | ≈33T · ~55 min | Insane |
| 21 |
Fordyv3-500k.rule
|
Mostly trims or deletes characters from the word; also tacks digits onto the end (years, 1, 123…), overwrites characters at specific positions inside the word. e.g. Password1
→ Passwordo
, Passwor1d1
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 500,000 | ≈27.5T · ~46 min | Insane |
| 22 |
hashcracky_500k.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also flips the case of individual letters (CamelCase / StUdLy variants), adds characters to the front (1word, !word…). e.g. Password1
→Password10
, Passw0rd0
→pASSW0RD0
, Password1
→!Password1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 490,540 | ≈27T · ~45 min | Insane |
| 23 |
fordyv1.rule
|
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), trims or deletes characters from the word. e.g. Password1
→ Passwo10r!
, Password
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 483,703 | ≈26.6T · ~44 min | Insane |
| 24 |
auto.rule
|
Mostly reshuffles characters or uses positional swap/memory ops; also reverses, duplicates or reflects the word, overwrites characters at specific positions inside the word. e.g. Password1
→ #Password1
, 01drowssPa
, sasQworb1
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 440,341 | ≈24.2T · ~40 min | Insane |
| 25 |
new-auto.rule
|
Mostly reshuffles characters or uses positional swap/memory ops; also reverses, duplicates or reflects the word, trims or deletes characters from the word. e.g. Password1
→ aPassword1.
, 01drowssPa
, Password
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 424,110 | ≈23.3T · ~39 min | Insane |
| 26 |
UnicornLorge.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly inserts characters at specific positions inside the word; also overwrites characters at specific positions inside the word, reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ PWassword1
, dassword1
, Oassword1
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 400,000 | ≈22T · ~37 min | Insane |
| 27 |
buka_400k.rule
|
Mostly trims or deletes characters from the word; also tacks digits onto the end (years, 1, 123…), overwrites characters at specific positions inside the word. e.g. Password1
→ Password
, Password123
, Qassword1
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 399,988 | ≈22T · ~37 min | Insane |
| 28 |
Fordyv2.rule
|
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), trims or deletes characters from the word. e.g. Password1
→ massword1!!
, Password1$Password15
, pASSWORD
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 382,629 | ≈21T · ~35 min | Insane |
| 29 |
KoreLogicRulesAppendSpecial4num.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends special 4 numbers. Mostly tacks symbols onto the end (!, @, #, $…); also tacks digits onto the end (years, 1, 123…), changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ Password1$0000
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends special 4 numbers). Pair with company names, seasons, months and a base dictionary of leaked founds. | 380,000 | ≈20.9T · ~35 min | Insane |
| 30 |
makeaddress_4digits.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly appends letters or whole words to the end; also adds characters to the front (1word, !word…). e.g. Password1
→ 1Password1Street
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 379,962 | ≈20.9T · ~35 min | Insane |
| 31 |
fordyv2a.rule
|
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), trims or deletes characters from the word. e.g. Password1
→ Passwo7d1
, Password1123
, pASSWORD
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 343,941 | ≈18.9T · ~32 min | Insane |
| 32 |
williamsuper.rule
|
Mostly overwrites characters at specific positions inside the word; also inserts characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ 000000assword1
, 000Pas000word1
, ssword10
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 314,962 | ≈17.3T · ~29 min | Insane |
| 33 |
hashcracky_300k.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also flips the case of individual letters (CamelCase / StUdLy variants), adds characters to the front (1word, !word…). e.g. Password1
→ Password10
, password1
, !Password1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 297,972 | ≈16.4T · ~27 min | Insane |
| 34 |
efensive.rule
|
Mostly reshuffles characters or uses positional swap/memory ops; also inserts characters at specific positions inside the word, trims or deletes characters from the word. e.g. Password1
→ Possward1 1
, Pa2ssword1
, Pssword1
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 250,623 | ≈13.8T · ~23 min | Insane |
| 35 |
Fordyv3-250k.rule
|
Mostly trims or deletes characters from the word; also tacks digits onto the end (years, 1, 123…), overwrites characters at specific positions inside the word. e.g. Password1
→ Passwordo
, Passwor1d1
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 250,000 | ≈13.8T · ~23 min | Insane |
| 36 |
fordyv2b.rule
|
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ Passwo0d1
, Password169
, Passwo88d1$
.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | 226,802 | ≈12.5T · ~21 min | Insane |
| 37 |
• techtrip_2.rule
• techtrip.rule
(family — 2 files) |
Mostly inserts characters at specific positions inside the word; also overwrites characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ afassword1
, asord1
, Password12013
. Differences:
members share ~202,122 core rules; techtrip_2.rule
adds ~18,692 more that inserts characters at specific positions inside the word; techtrip.rule
adds ~3 more that adds characters to the front.
|
Supplementary general cracking on fast-hash dumps. Pair with RockYou or weakpass. | 202,125–220,814 | ≈12.1T · ~20 min | Insane |
| 38 |
blandyuk_sym_ins.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ \Password1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 215,296 | ≈11.8T · ~20 min | Insane |
| 39 |
• Shooter3k_8_20_2021.rule
• Shooter3k_8_21_2021Cleaned.rule
(family — 2 files) |
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ Passwo16d1
, Password1123456
. Differences:
members share ~205,036 core rules; Shooter3k_8_20_2021.rule
adds ~1,746 more that tacks digits onto the end; Shooter3k_8_21_2021Cleaned.rule
adds ~708 more that inserts characters at specific positions inside the word.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 205,744–206,782 | ≈11.4T · ~19 min | Insane |
| 40 |
blandyuk_sym_rep.rule
|
Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ \assword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 202,304 | ≈11.1T · ~19 min | Insane |
| 41 |
blandyuk_la_ins16.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ aPassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 173,056 | ≈9.5T · ~16 min | Insane |
| 42 |
blandyuk_ua_ins16.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ APassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 173,056 | ≈9.5T · ~16 min | Insane |
| 43 |
clem9669_medium.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also adds characters to the front (1word, !word…), tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password1 00
, !Password1!
.
|
General human passwords incl. French/accented and emoji — fine for dumps and WPA. Pair with a multilingual or RockYou-style list. | 170,500 | ≈9.4T · ~16 min | Insane |
| 44 |
blandyuk_la_rep16.rule
|
Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ aassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 162,656 | ≈8.9T · ~15 min | Insane |
| 45 |
blandyuk_ua_rep16.rule
|
Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ Aassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 162,656 | ≈8.9T · ~15 min | Insane |
| 46 |
HashMob.150k.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ Psword1111
, Password107
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 150,000 | ≈8.2T · ~14 min | Insane |
| 47 |
email.rule
|
Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1@0-00.usa.cc
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 146,461 | ≈8.1T · ~13 min | Insane |
| 48 |
Robot_MyFavorite.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also overwrites characters at specific positions inside the word, trims or deletes characters from the word. e.g. Password1
→ Password1 007
, massword1!!
, sword1
.
|
General fast-hash cracking incl. reversed-guess passes. Pair with RockYou or HashMob founds. | 134,731 | ≈7.4T · ~12 min | Insane |
| 49 |
blandyuk_digit_ins_4.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 0000Password1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 130,000 | ≈7.2T · ~12 min | Insane |
| 50 |
_NSAKEY.v1.dive.rule
|
An aggressive, progressively deeper set that stacks inserts, overwrites, toggles and truncations to reach unusual mutations. Mostly overwrites characters at specific positions inside the word; also inserts characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ P0ssword1
, P'''assword1
, Password11
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 123,289 | ≈6.8T · ~11 min | Insane |
| 51 |
_NSAKEY.v2.dive.rule
|
An aggressive, progressively deeper set that stacks inserts, overwrites, toggles and truncations to reach unusual mutations. Mostly overwrites characters at specific positions inside the word; also inserts characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ kassword1
, P'''assword1
, Password11
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 123,289 | ≈6.8T · ~11 min | Insane |
| 52 |
blandyuk_names_ins.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ aakarshanPassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 111,210 | ≈6.1T · ~10 min | Insane |
| 53 |
TOXIC-10krules.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 1Password1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 108,236 | ≈6T · ~10 min | Insane |
| 54 |
DiveIcorn.rule
|
An aggressive, progressively deeper set that stacks inserts, overwrites, toggles and truncations to reach unusual mutations. Mostly overwrites characters at specific positions inside the word; also inserts characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ dassword1
, PWassword1
, Password11
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 100,000 | ≈5.5T · ~9 min | Slow |
| 55 |
HashMob.100k.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ Psword1111
, Password107
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 100,000 | ≈5.5T · ~9 min | Slow |
| 56 |
dive.rule
|
An aggressive, progressively deeper set that stacks inserts, overwrites, toggles and truncations to reach unusual mutations. Mostly reshuffles characters or uses positional swap/memory ops; also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ Paasword1
, assword1
, 1Pa2ssword
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 99,086 | ≈5.4T · ~9 min | Slow |
| 57 |
blandyuk_la_ins12.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ aPassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 97,344 | ≈5.4T · ~9 min | Slow |
| 58 |
blandyuk_ua_ins12.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ APassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 97,344 | ≈5.4T · ~9 min | Slow |
| 59 |
evil.rule
|
Mostly overwrites characters at specific positions inside the word; also swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7), inserts characters at specific positions inside the word. e.g. Password1
→ 000000assword1
, aPssword1
, a1Pssword1
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 90,713 | ≈5T · ~8 min | Slow |
| 60 |
blandyuk_la_rep12.rule
|
Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ aassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 89,544 | ≈4.9T · ~8 min | Slow |
| 61 |
blandyuk_ua_rep12.rule
|
Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ Aassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 89,544 | ≈4.9T · ~8 min | Slow |
| 62 |
HashMob.75k.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ Psword1111
, Password107
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 75,000 | ≈4.1T · ~7 min | Slow |
| 63 |
generated2.rule
|
Machine-generated rules (hashcat-utils) — randomized stacks of inserts, overwrites and swaps for broad brute-ish coverage. Mostly reshuffles characters or uses positional swap/memory ops; also reverses, duplicates or reflects the word, overwrites characters at specific positions inside the word. e.g. Password1
→ Prsswoad1
, Password1Password1Password1
, Passw*rd1
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 65,117 | ≈3.6T · ~6 min | Slow |
| 64 |
KoreLogicRulesAppendSpecialNumberNumberNumber.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends special number number number. Mostly tacks symbols onto the end (!, @, #, $…); also tacks digits onto the end (years, 1, 123…), changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→Password1^000
, Passw0rd0
→Passw0rd0^000
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends special number number number). Pair with company names, seasons, months and a base dictionary of leaked founds. | 62,000 | ≈3.4T · ~6 min | Slow |
| 65 |
PrependRockYou60000.rule
|
Rules statistically derived from what actually cracked the RockYou breach. Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 1Password1
.
|
Everyday human breach passwords on fast hashes — a solid general dump pass. Pair with RockYou or HashMob founds. | 59,137 | ≈3.3T · ~5 min | Slow |
| 66 |
d3adhob0.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also tacks symbols onto the end (!, @, #, $…), changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→Password10000
, Password1
→Password1!
, cat
→Cat
.
|
General human dumps — hob064 as a fast pass, d3adhob0 for depth. Pair with RockYou or founds. | 57,540 | ≈3.2T · ~5 min | Slow |
| 67 |
• OneRuleToRuleThemAll.rule
• OneRuleToRuleThemStill.rule
(family — 2 files) |
A community 'mega rule' that unions the best-performing rules from many popular sets into one exhaustive pass. Mostly overwrites characters at specific positions inside the word; also adds characters to the front (1word, !word…), tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Passwooi1
, sPassword1
, Passwordd9
. Differences:
members share ~49,228 core rules; OneRuleToRuleThemAll.rule
adds ~2,772 more that inserts characters at specific positions inside the word; OneRuleToRuleThemStill.rule
adds ~1 more that reshuffles characters or uses positional swap/memory ops.
|
Broad human-password coverage on fast unsalted hashes (NTLM/NTDS, MD5, SHA1); overkill for slow WPA/bcrypt. Pair with RockYou, weakpass or HashMob founds. | 49,229–52,000 | ≈2.9T · ~5 min | Slow |
| 68 |
TheOneTrueUnicorn.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly overwrites characters at specific positions inside the word; also inserts characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ dassword1
, PWassword1
, Password11
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 52,000 | ≈2.9T · ~5 min | Slow |
| 69 |
hashes-org-rules.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also adds characters to the front (1word, !word…), changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ Password11 >
, +Password1
, PASSWORD1}
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 51,625 | ≈2.8T · ~5 min | Slow |
| 70 |
HashMob.50k.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ Psword1111
, Password107
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 50,000 | ≈2.8T · ~5 min | Slow |
| 71 |
KoreLogicRulesPrependRockYou50000.rule
|
Rules statistically derived from what actually cracked the RockYou breach. Mostly adds characters to the front (1word, !word…). e.g. Password1
→ passwordPassword1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends rock you 50000). Pair with company names, seasons, months and a base dictionary of leaked founds. | 49,997 | ≈2.7T · ~5 min | Slow |
| 72 |
hashcracky_50k.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also flips the case of individual letters (CamelCase / StUdLy variants), adds characters to the front (1word, !word…). e.g. Password1
→ Password10
, pASSWORD1
, !Password1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 44,972 | ≈2.5T · ~4 min | Slow |
| 73 |
T0XlC_both.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly adds characters to the front (1word, !word…); also appends letters or whole words to the end, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ 1Password1
, Password1e
, Password10
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 40,084 | ≈2.2T · ~4 min | Slow |
| 74 |
blandyuk_word5_ins.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ abackPassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 40,032 | ≈2.2T · ~4 min | Slow |
| 75 |
Robot_ReverseRules.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, overwrites characters at specific positions inside the word. e.g. Password1
→ Password1!
, password1
, cssword1
.
|
General fast-hash cracking incl. reversed-guess passes. Pair with RockYou or HashMob founds. | 39,358 | ≈2.2T · ~4 min | Slow |
| 76 |
makeaddress_3digits.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly appends letters or whole words to the end; also adds characters to the front (1word, !word…). e.g. Password1
→ 1Password1Street
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 37,962 | ≈2.1T · ~3 min | Slow |
| 77 |
blandyuk_append_sym_year.rule
|
Mostly tacks symbols onto the end (!, @, #, $…); also tacks digits onto the end (years, 1, 123…), changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ Password1\1500
, PASSWORD1\1500
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 37,262 | ≈2T · ~3 min | Slow |
| 78 |
d3ad0ne.rule
|
A large classic set mined from real cracked passwords, mixing case, append, insert and leet mutations. Mostly trims or deletes characters from the word; also reshuffles characters or uses positional swap/memory ops, reverses, duplicates or reflects the word. e.g. Password1
→ Pssword1
, sasPword1
, PPPassworu1
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 34,109 | ≈1.9T · ~3 min | Slow |
| 79 |
haku34K.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ Password1123
, Password
, Password21
.
|
Human passwords incl. non-English and WPA-length, tuned on real leaks (Kaonashi). Pair with the Kaonashi list or a large breach-founds wordlist. | 34,101 | ≈1.9T · ~3 min | Slow |
| 80 |
kamaji34K.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also adds characters to the front (1word, !word…), reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ Password11
, 1Password1
, password1
.
|
Human passwords incl. non-English and WPA-length, tuned on real leaks (Kaonashi). Pair with the Kaonashi list or a large breach-founds wordlist. | 34,101 | ≈1.9T · ~3 min | Slow |
| 81 |
blandyuk_leet_tog_num.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7); also changes capitalization (lowercase, UPPERCASE or Capitalized), flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→P@ssword1
, Password1
→p@ssword1
, Passw0rd0
→P@ssw0rd0
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 32,043 | ≈1.8T · ~3 min | Slow |
| 82 |
hashcracky_append_30k.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password10
, Password1!
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 30,000 | ≈1.6T · ~3 min | Slow |
| 83 |
hashcracky_phrase_30k.rule
|
Mostly adds characters to the front (1word, !word…); also trims or deletes characters from the word, flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ ViaApassword1
, bad
.
|
Multi-word passphrases — best for WPA/WPA2 PSKs (8–63 chars) and disk encryption. Pair with phrase lists, song lyrics or book-text wordlists. | 30,000 | ≈1.6T · ~3 min | Slow |
| 84 |
hashcracky_poggle_30k.rule
|
Mostly adds characters to the front (1word, !word…); also flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ Aa.Password1
, Aaapassword1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 30,000 | ≈1.6T · ~3 min | Slow |
| 85 |
hashcracky_prepend_30k.rule
|
Mostly adds characters to the front (1word, !word…). e.g. Password1
→ aaaPassword1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 30,000 | ≈1.6T · ~3 min | Slow |
| 86 |
hashcracky_taggle_30k.rule
|
Mostly flips the case of individual letters (CamelCase / StUdLy variants); also tacks digits onto the end (years, 1, 123…), tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ password1!
, password10
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 30,000 | ≈1.6T · ~3 min | Slow |
| 87 |
rockyou-30000.rule
|
Rules statistically derived from what actually cracked the RockYou breach. Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ Passwo1d1
, Password11
, Pas123word1
.
|
Everyday human breach passwords on fast hashes — a solid general dump pass. Pair with RockYou or HashMob founds. | 30,000 | ≈1.6T · ~3 min | Slow |
| 88 |
blandyuk_digit_ins_2.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 0Password1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 24,160 | ≈1.3T · ~2 min | Slow |
| 89 |
blandyuk_sym2_ins.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ !Password1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 24,160 | ≈1.3T · ~2 min | Slow |
| 90 |
blandyuk_word4_ins.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ abbePassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 22,880 | ≈1.3T · ~2 min | Slow |
| 91 |
KoreLogicRulesAddJustNumbersLimit8.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — add just numbers limit 8. Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also tacks digits onto the end (years, 1, 123…) — applied only to words that pass a length/content filter. e.g. cat
→ Cat0000
, 00Cat
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — add just numbers limit 8). Pair with company names, seasons, months and a base dictionary of leaked founds. | 22,440 | ≈1.2T · ~2 min | Slow |
| 92 |
• giveen_combo.rule
• KoreLogicRulesAppend4Num.rule
(family — 2 files) |
Mostly tacks digits onto the end (years, 1, 123…); also changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ Password10
, PASSWORD1
. Differences:
members share ~20,000 core rules; giveen_combo.rule
adds ~1,622 more that inserts characters at specific positions inside the word.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 20,000–21,622 | ≈1.2T · ~2 min | Slow |
| 93 |
T0XlC_ins.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ sPassword1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 20,711 | ≈1.1T · ~2 min | Slow |
| 94 |
T0XlC_rep.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ sassword1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 20,711 | ≈1.1T · ~2 min | Slow |
| 95 |
HashMob.20k.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ Psword1111
, Password107
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 20,000 | ≈1.1T · ~2 min | Slow |
| 96 |
KoreLogicRulesPrepend2NumbersAppend2Numbers.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends 2 numbers appends 2 numbers. Mostly inserts characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ 00Password100
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends 2 numbers appends 2 numbers). Pair with company names, seasons, months and a base dictionary of leaked founds. | 20,000 | ≈1.1T · ~2 min | Slow |
| 97 |
KoreLogicRulesPrependNumNumNumNum.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends numbers numbers numbers numbers. Mostly inserts characters at specific positions inside the word; also changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ 0000Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends numbers numbers numbers numbers). Pair with company names, seasons, months and a base dictionary of leaked founds. | 20,000 | ≈1.1T · ~2 min | Slow |
| 98 |
Unicorn20k.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly overwrites characters at specific positions inside the word; also inserts characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ dassword1
, PWassword1
, Password11
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 20,000 | ≈1.1T · ~2 min | Slow |
| 99 |
T0XlCv2.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word; also tacks symbols onto the end (!, @, #, $…), tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Passy
, Password1!
, Password1!1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 19,562 | ≈1.1T · ~2 min | Slow |
| 100 |
lmNTLM.rule
|
Mostly flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ PassworD1
, password1
.
|
Legacy Windows LM/NTLM quirks (uppercasing/splitting). Pair with any list when auditing LM hashes. | 16,388 | ≈901.3B · ~2 min | Slow |
| 101 |
Incisive-leetspeak.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P@ssword1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 15,487 | ≈851.8B · ~85 s | Slow |
| 102 |
generated.rule
|
Machine-generated rules (hashcat-utils) — randomized stacks of inserts, overwrites and swaps for broad brute-ish coverage. Mostly reshuffles characters or uses positional swap/memory ops; also trims or deletes characters from the word, overwrites characters at specific positions inside the word. e.g. Password1
→ Password0
, ssword1
, Pass ord1
.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 14,728 | ≈810B · ~81 s | Slow |
| 103 |
blandyuk_digit_ins_3.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 000Password1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 14,000 | ≈770B · ~77 s | Slow |
| 104 |
KoreLogicRulesPrependCAPCAPAppendSpecial.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends capcap appends special. Mostly tacks symbols onto the end (!, @, #, $…); also inserts characters at specific positions inside the word. e.g. Password1
→ AAPassword1!
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends capcap appends special). Pair with company names, seasons, months and a base dictionary of leaked founds. | 12,844 | ≈706.4B · ~71 s | Slow |
| 105 |
T0XlCv1.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word; also changes capitalization (lowercase, UPPERCASE or Capitalized), tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ passws
, passpass
, PASSWORD1~!@#$
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 11,931 | ≈656.2B · ~66 s | Slow |
| 106 |
blandyuk_years_ins.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 1600Password1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 10,413 | ≈572.7B · ~57 s | Slow |
| 107 |
email_by_simplify.rule
|
Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1@0039.cf
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 10,326 | ≈567.9B · ~57 s | Slow |
| 108 |
HashMob.10k.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ Psword1111
, Password107
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 10,000 | ≈550B · ~55 s | Slow |
| 109 |
nyxgeek-append4.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password10000
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 10,000 | ≈550B · ~55 s | Slow |
| 110 |
Unicorn10k.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ dassword1
, Password11
, PWassword1
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 10,000 | ≈550B · ~55 s | Slow |
| 111 |
hashcracky_10k.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, overwrites characters at specific positions inside the word. e.g. Password1
→ Password10
, assword1
, (assword1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 9,195 | ≈505.7B · ~51 s | Slow |
| 112 |
OptimizedUpToDate.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, adds characters to the front (1word, !word…). e.g. Password1
→ password1@123
, r1@
, 6dpassword1
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 8,477 | ≈466.2B · ~47 s | Slow |
| 113 |
prince_generated.rule
|
Mostly reshuffles characters or uses positional swap/memory ops; also swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7), trims or deletes characters from the word. e.g. Password1
→ Oassword1
, Passwordy
, assword1
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 8,452 | ≈464.9B · ~46 s | Slow |
| 114 |
KoreLogicRulesPrependMonthDayYear.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends month day year. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 000000Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends month day year). Pair with company names, seasons, months and a base dictionary of leaked founds. | 8,000 | ≈440B · ~44 s | Slow |
| 115 |
nyxgeek-repeater-i.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 0000Password1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 7,360 | ≈404.8B · ~40 s | Slow |
| 116 |
• T0XlC_ins2_basic.rule
• T0XlC_ins2.rule
(family — 2 files) |
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 1Password1
, password1
, pASSWORD1
. Differences:
members share ~6,921 core rules; T0XlC_ins2_basic.rule
adds ~7 more that changes capitalization.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 6,921–6,928 | ≈381B · ~38 s | Slow |
| 117 |
T0XlC_rep2.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ 1assword1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 6,921 | ≈380.7B · ~38 s | Slow |
| 118 |
T0XlC_insert_HTML_entities_0_Z.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word. e.g. Password1
→  Password1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 6,662 | ≈366.4B · ~37 s | Slow |
| 119 |
InsidePro-HashManager.rule
|
Mostly inserts characters at specific positions inside the word; also changes capitalization (lowercase, UPPERCASE or Capitalized), overwrites characters at specific positions inside the word. e.g. Password1
→ Pa12ssword1
, password1
, P ssword1
.
|
Legacy general coverage, strong on classic common patterns in old dumps. Pair with RockYou. | 6,551 | ≈360.3B · ~36 s | Slow |
| 120 |
blandyuk_word3_ins.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ acePassword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 6,356 | ≈349.6B · ~35 s | Slow |
| 121 |
KoreLogicRulesPrependNumNumSpecial.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends numbers numbers special. Mostly inserts characters at specific positions inside the word; also changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ 00^Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends numbers numbers special). Pair with company names, seasons, months and a base dictionary of leaked founds. | 6,200 | ≈341B · ~34 s | Slow |
| 122 |
T0XlC-insert_00-99_1950-2050_toprules_0_F.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 1930Password1
, password1
, Password1123
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 5,616 | ≈308.9B · ~31 s | Slow |
| 123 |
HashMob.5k.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly trims or deletes characters from the word; also tacks digits onto the end (years, 1, 123…), reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ Psword1111
, Passwor1
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 5,000 | ≈275B · ~28 s | Medium |
| 124 |
top_5000.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also adds characters to the front (1word, !word…), trims or deletes characters from the word. e.g. Password1
→ Password11
, sPassword1
, assword1
.
|
Highest-yield rules when time-boxed — any fast-hash dump. Pair with RockYou or weakpass. | 5,000 | ≈275B · ~28 s | Medium |
| 125 |
toprules2020.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also adds characters to the front (1word, !word…), appends letters or whole words to the end. e.g. Password1
→ Password1 1
, @Password1#
, Password1 <3
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 5,000 | ≈275B · ~28 s | Medium |
| 126 |
Unicorn5k.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), trims or deletes characters from the word. e.g. Password1
→ dassword1
, Password11
, Password
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 5,000 | ≈275B · ~28 s | Medium |
| 127 |
toggles5.rule
|
Pure case-toggling: flips letter case at fixed positions to cover CamelCase/StUdLy spellings. Mostly flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ password1
.
|
Case-sensitive targets — NTLM/AD and any dump where only capitalization varies. Pair with a list already close to the target (e.g. cracked founds). | 4,943 | ≈271.9B · ~27 s | Medium |
| 128 |
append-firstnames.rule
|
Mostly appends letters or whole words to the end. e.g. Password1
→ Password1aaren
, Password1ann-marie
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 4,940 | ≈271.7B · ~27 s | Medium |
| 129 |
corporate.rule
|
Targets enterprise complexity policies — Capital + word + digits + special, season/year styles. Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also tacks digits onto the end (years, 1, 123…), tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password10
, Password10.
.
|
Active Directory / Windows NTLM under complexity policy — Capitalised word + digits + special, Season/Year. Pair with a company/OSINT wordlist plus months &years. | 4,578 | ≈251.8B · ~25 s | Medium |
| 130 |
KoreLogicRulesAppendJustNumbers.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends just numbers. Mostly tacks digits onto the end (years, 1, 123…); also changes capitalization (lowercase, UPPERCASE or Capitalized), inserts characters at specific positions inside the word. e.g. Password1
→ Password10
, 00Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends just numbers). Pair with company names, seasons, months and a base dictionary of leaked founds. | 4,440 | ≈244.2B · ~24 s | Medium |
| 131 |
hashcracky_5k.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, overwrites characters at specific positions inside the word. e.g. Password1
→ Password10
, assword1
, @assword1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 4,366 | ≈240.1B · ~24 s | Medium |
| 132 |
KoreLogicRulesL33t.rule
|
KoreLogic DEF CON contest rule — a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7); also changes capitalization (lowercase, UPPERCASE or Capitalized) — applied only to words that pass a length/content filter. e.g. Password1
→ p@ssword1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 4,260 | ≈234.3B · ~23 s | Medium |
| 133 |
T0XlC.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also appends letters or whole words to the end, tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ PASSWORD1~!@#$
, PASSWORD1z
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 4,085 | ≈224.7B · ~22 s | Medium |
| 134 |
mail.rule
|
Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1@gmail.com
, Password1@1033edge.com
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 3,628 | ≈199.5B · ~20 s | Medium |
| 135 |
• InsidePro-PasswordsPro.rule
• passwordspro.rule
(family — 2 files) |
Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ password1
, Password10
, P0assword1
. Differences:
members share ~3,120 core rules; InsidePro-PasswordsPro.rule
adds ~114 more that tacks digits onto the end.
|
Legacy general coverage, strong on classic common patterns in old dumps. Pair with RockYou. | 3,141–3,234 | ≈177.9B · ~18 s | Medium |
| 136 |
unix-ninja-leetspeak.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P4ssword1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 3,071 | ≈168.9B · ~17 s | Medium |
| 137 |
emojis.rule
|
Mostly tacks symbols onto the end (!, @, #, $…); also trims or deletes characters from the word. e.g. Password1
→ Password1$:-*
, Password1$:x
, Password10:)
.
|
General human passwords incl. French/accented and emoji — fine for dumps and WPA. Pair with a multilingual or RockYou-style list. | 3,007 | ≈165.4B · ~17 s | Medium |
| 138 |
top_3000.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, adds characters to the front (1word, !word…). e.g. Password1
→ Password11
, assword1
, sPassword1
.
|
Highest-yield rules when time-boxed — any fast-hash dump. Pair with RockYou or weakpass. | 3,000 | ≈165B · ~16 s | Medium |
| 139 |
Unicorn3k.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), trims or deletes characters from the word. e.g. Password1
→ dassword1
, Password11
, Password
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 3,000 | ≈165B · ~16 s | Medium |
| 140 |
KoreLogicRulesAppend2Letters.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends 2 letters. Mostly appends letters or whole words to the end. e.g. Password1
→ Password1aa
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends 2 letters). Pair with company names, seasons, months and a base dictionary of leaked founds. | 2,704 | ≈148.7B · ~15 s | Medium |
| 141 |
KoreLogicRulesPrependDaysWeek.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends days week. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ mondayPassword1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends days week). Pair with company names, seasons, months and a base dictionary of leaked founds. | 2,496 | ≈137.3B · ~14 s | Medium |
| 142 |
unix-ninja_common-leetspeak.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P4ssword1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 2,047 | ≈112.6B · ~11 s | Medium |
| 143 |
KoreLogicRulesPrependNumNumNum.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends numbers numbers numbers. Mostly adds characters to the front (1word, !word…); also changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→000Password1
, Passw0rd0
→000Passw0rd0
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends numbers numbers numbers). Pair with company names, seasons, months and a base dictionary of leaked founds. | 2,000 | ≈110B · ~11 s | Medium |
| 144 |
toggles4.rule
|
Pure case-toggling: flips letter case at fixed positions to cover CamelCase/StUdLy spellings. Mostly flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ password1
.
|
Case-sensitive targets — NTLM/AD and any dump where only capitalization varies. Pair with a list already close to the target (e.g. cracked founds). | 1,940 | ≈106.7B · ~11 s | Medium |
| 145 |
T0XlC-insert_top_100_passwords_1_G.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ P123assword1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 1,601 | ≈88.1B · ~9 s | Medium |
| 146 |
top_1500.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, adds characters to the front (1word, !word…). e.g. Password1
→ Password11
, assword1
, sPassword1
.
|
Highest-yield rules when time-boxed — any fast-hash dump. Pair with RockYou or weakpass. | 1,500 | ≈82.5B · ~8 s | Medium |
| 147 |
KoreLogicRulesPrependSpecialSpecial.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends special special. Mostly adds characters to the front (1word, !word…). e.g. Password1
→ ^Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends special special). Pair with company names, seasons, months and a base dictionary of leaked founds. | 1,458 | ≈80.2B · ~8 s | Medium |
| 148 |
KoreLogicRulesAppendNumberNumberSpecialTwice.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends number number special twice. Mostly tacks digits onto the end (years, 1, 123…); also tacks symbols onto the end (!, @, #, $…), changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→Password100$$
, Passw0rd0
→Passw0rd000$$
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends number number special twice). Pair with company names, seasons, months and a base dictionary of leaked founds. | 1,400 | ≈77B · ~8 s | Medium |
| 149 |
Pengo.rule
|
Mostly inserts characters at specific positions inside the word; also reshuffles characters or uses positional swap/memory ops, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ P!assword1
, aPssword1
, Password10
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 1,368 | ≈75.2B · ~8 s | Medium |
| 150 |
KoreLogicRulesAppendMonthDay.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends month day. Mostly appends letters or whole words to the end; also tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1mar
, Password1mar0
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends month day). Pair with company names, seasons, months and a base dictionary of leaked founds. | 1,344 | ≈73.9B · ~7 s | Medium |
| 151 |
KoreLogicRulesReplaceLetters.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — replace letters. Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7) — applied only to words that pass a length/content filter. e.g. Password1
→ Pbssword1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 1,293 | ≈71.1B · ~7 s | Medium |
| 152 |
Robot_Top1268Rules.rule
|
Mostly adds characters to the front (1word, !word…); also trims or deletes characters from the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ 6dpassword1
, r1@
, password1@123
.
|
General fast-hash cracking incl. reversed-guess passes. Pair with RockYou or HashMob founds. | 1,268 | ≈69.7B · ~7 s | Medium |
| 153 |
prince_optimized.rule
|
Mostly flips the case of individual letters (CamelCase / StUdLy variants); also reshuffles characters or uses positional swap/memory ops, swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ pASSWORD1
, aPssword1
, Passw0rd1
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 1,156 | ≈63.6B · ~6 s | Medium |
| 154 |
KoreLogicRulesPrependJustSpecials.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends just special chars. Mostly adds characters to the front (1word, !word…). e.g. Password1
→ ^Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends just special chars). Pair with company names, seasons, months and a base dictionary of leaked founds. | 1,056 | ≈58.1B · ~6 s | Medium |
| 155 |
Dipepe_emails_top1k_v4.0.rule
|
Mostly overwrites characters at specific positions inside the word; also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ kassword1
, @gmail.com
, Phassword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 1,000 | ≈55B · ~6 s | Medium |
| 156 |
HashMob.1k.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ Psword1111
, Passwor1
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 1,000 | ≈55B · ~6 s | Medium |
| 157 |
• newttv1.rule
• techtrip1000.rule
(family — 2 files) |
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), inserts characters at specific positions inside the word. e.g. Password1
→ jassword1
, Password11
, P123456ssword1
. Differences:
all 2 are effectively identical (~1,000 shared rules; differ only in ordering/line-endings).
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 1,000 | ≈55B · ~6 s | Medium |
| 158 |
Unicorn1k.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), adds characters to the front (1word, !word…). e.g. Password1
→ dassword1
, Password11
, 1Password1
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 1,000 | ≈55B · ~6 s | Medium |
| 159 |
skalman_takesuonadate.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ Password12021
, Passw2021
, pASSWORD12021
.
|
Quick lightweight passes and date tweaks on any dump. Pair with RockYou. | 947 | ≈52.1B · ~5 s | Medium |
| 160 |
KoreLogicRulesPrependNumNum3LetterMonths.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends numbers numbers 3 letter months. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 00janPassword1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends numbers numbers 3 letter months). Pair with company names, seasons, months and a base dictionary of leaked founds. | 880 | ≈48.4B · ~5 s | Medium |
| 161 |
nyxgeek-i1.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ Paassword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 828 | ≈45.5B · ~5 s | Medium |
| 162 |
nyxgeek-o1.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly overwrites characters at specific positions inside the word. e.g. Password1
→ Pbssword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 828 | ≈45.5B · ~5 s | Medium |
| 163 |
top_750.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, adds characters to the front (1word, !word…). e.g. Password1
→ Password11
, assword1
, sPassword1
.
|
Highest-yield rules when time-boxed — any fast-hash dump. Pair with RockYou or weakpass. | 750 | ≈41.2B · ~4 s | Medium |
| 164 |
KoreLogicRulesAddShortMonthsEverywhere.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — add short months everywhere. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ aprPassword1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — add short months everywhere). Pair with company names, seasons, months and a base dictionary of leaked founds. | 688 | ≈37.8B · ~4 s | Medium |
| 165 |
blandyuk_sym_pre_app.rule
|
Mostly tacks symbols onto the end (!, @, #, $…); also adds characters to the front (1word, !word…). e.g. Password1
→ !Password1!
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 625 | ≈34.4B · ~3 s | Medium |
| 166 |
• append_email_domains(giveen).rule
• mail_Milzo.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end. e.g. Password1
→ Password1@hotmail.com
, Password1@163.com
, $321@1drowssaPan.com
. Differences:
all 2 are effectively identical (~580 shared rules; differ only in ordering/line-endings).
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 596 | ≈32.8B · ~3 s | Medium |
| 167 |
basic_4_mail.rule
|
Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also tacks symbols onto the end (!, @, #, $…), appends letters or whole words to the end. e.g. Password1
→ password1@password1.ac
, admin@password1.com
, password1@126.com
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 575 | ≈31.6B · ~3 s | Medium |
| 168 |
toggles3.rule
|
Pure case-toggling: flips letter case at fixed positions to cover CamelCase/StUdLy spellings. Mostly flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ password1
.
|
Case-sensitive targets — NTLM/AD and any dump where only capitalization varies. Pair with a list already close to the target (e.g. cracked founds). | 575 | ≈31.6B · ~3 s | Medium |
| 169 |
ProbWL-547-rule-probable-v2.rule
|
Mostly overwrites characters at specific positions inside the word; also tacks digits onto the end (years, 1, 123…), swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ Passwor11
, Password11
, Pa11word1
.
|
General human passwords — designed to pair with the Probable-Wordlists dictionaries (Top-x-probable). | 547 | ≈30.1B · ~3 s | Medium |
| 170 |
T0XlC-insert_space_and_special_0_F.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ P assword1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 512 | ≈28.2B · ~3 s | Medium |
| 171 |
KoreLogicRulesReplaceSpecial2Special.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — replace special 2 special. Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7) — applied only to words that pass a length/content filter. | Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 508 | ≈27.9B · ~3 s | Medium |
| 172 |
top_500.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, adds characters to the front (1word, !word…). e.g. Password1
→ Password11
, assword1
, sPassword1
.
|
Highest-yield rules when time-boxed — any fast-hash dump. Pair with RockYou or weakpass. | 500 | ≈27.5B · ~3 s | Medium |
| 173 |
hashcracky_500.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→Password10
, Password1
→assword1
, Passw0rd0
→passw0rd0
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 484 | ≈26.6B · ~3 s | Medium |
| 174 |
• Dipepe_full_names_to_emails_top100.rule
• full_names_to_emails_top100.rule
(family — 2 files) |
Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end, swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→Password1@yahoo.com
, Passw0rd0
→Passw0rd0@yahoo.com
. Differences:
members share ~400 core rules; Dipepe_full_names_to_emails_top100.rule
adds ~1 more that passes the word through unchanged.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 400–401 | ≈22.1B · ~2 s | Medium |
| 175 |
clem9669_small.rule
|
Mostly flips the case of individual letters (CamelCase / StUdLy variants); also adds characters to the front (1word, !word…), appends letters or whole words to the end. e.g. Password1
→ password1
, !Password1
, Password1a
.
|
General human passwords incl. French/accented and emoji — fine for dumps and WPA. Pair with a multilingual or RockYou-style list. | 385 | ≈21.2B · ~2 s | Medium |
| 176 |
nyxgeek-weird1.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ Paasasword1
, P0acscscwcord1
, P0adsdsdwdord1P0adsdsdwdord1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 368 | ≈20.2B · ~2 s | Medium |
| 177 |
skalman_test.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ assword189
, Pasword1
, password1
.
|
Quick lightweight passes and date tweaks on any dump. Pair with RockYou. | 281 | ≈15.5B · ~2 s | Medium |
| 178 |
• Oscommerce.rule
• oscommerce.rule
(family — 2 files) |
Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 00Password1
. Differences:
all 2 are effectively identical (~256 shared rules; differ only in ordering/line-endings).
|
Application/format-specific tweaks — use against that specific target. Pair with a general or app-themed list. | 256 | ≈14.1B · ~1 s | Medium |
| 179 |
cyclone_250.rule
|
Mostly trims or deletes characters from the word; also tacks digits onto the end (years, 1, 123…), adds characters to the front (1word, !word…). e.g. Password1
→ Password
, Password11
, @Password1
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 250 | ≈13.8B · ~1 s | Medium |
| 180 |
top_250.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, adds characters to the front (1word, !word…). e.g. Password1
→ Password11
, assword1
, sPassword1
.
|
Highest-yield rules when time-boxed — any fast-hash dump. Pair with RockYou or weakpass. | 250 | ≈13.8B · ~1 s | Medium |
| 181 |
Unicorn250.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly tacks digits onto the end (years, 1, 123…); also overwrites characters at specific positions inside the word, reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ Password11
, dassword1
, Oassword1
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 250 | ≈13.8B · ~1 s | Medium |
| 182 |
Dipepe_Extract_range_1.rule
|
Mostly trims or deletes characters from the word. e.g. Password1
→ P
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 241 | ≈13.3B · ~1 s | Medium |
| 183 |
Dipepe_Omit_range_1.rule
|
Mostly trims or deletes characters from the word. e.g. Password1
→ assword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 241 | ≈13.3B · ~1 s | Medium |
| 184 |
emails_best.rule
|
Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7); also trims or deletes characters from the word, appends letters or whole words to the end. e.g. Passw0rd0
→Passw1rd1
, Password1
→Password
, Password1
→Passworcom
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 238 | ≈13.1B · ~1 s | Medium |
| 185 |
Robot_toporder.rule
|
Mostly trims or deletes characters from the word; also overwrites characters at specific positions inside the word, adds characters to the front (1word, !word…). e.g. Password1
→ password1
, cssword1
, aPword1
.
|
General fast-hash cracking incl. reversed-guess passes. Pair with RockYou or HashMob founds. | 234 | ≈12.9B · ~1 s | Medium |
| 186 |
KoreLogicRulesPrependNumNum.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends numbers numbers. Mostly inserts characters at specific positions inside the word; also changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ 00Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends numbers numbers). Pair with company names, seasons, months and a base dictionary of leaked founds. | 200 | ≈11B · ~1 s | Medium |
| 187 |
ProbWL-197-rule-probable-v2.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also overwrites characters at specific positions inside the word. e.g. Password1
→ Password11
, Passwor11
.
|
General human passwords — designed to pair with the Probable-Wordlists dictionaries (Top-x-probable). | 197 | ≈10.8B · ~1 s | Medium |
| 188 |
blandyuk.rule
|
Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7); also adds characters to the front (1word, !word…), tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Pa$$word1!
, adminPassword1
, Password1admin:
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 178 | ≈9.8B · <1 s | Medium |
| 189 |
specific.rule
|
Mostly reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ aPssword1
.
|
Application/format-specific tweaks — use against that specific target. Pair with a general or app-themed list. | 176 | ≈9.7B · <1 s | Medium |
| 190 |
blandyuk_sym1_ins.rule
|
Mostly inserts characters at specific positions inside the word. e.g. Password1
→ (Password1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 160 | ≈8.8B · <1 s | Medium |
| 191 |
KoreLogicRulesAppendYears.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends years. Mostly tacks digits onto the end (years, 1, 123…); also changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ Password11940
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends years). Pair with company names, seasons, months and a base dictionary of leaked founds. | 160 | ≈8.8B · <1 s | Medium |
| 192 |
basic_m@il.rule
|
Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also trims or deletes characters from the word, inserts characters at specific positions inside the word. e.g. Password1
→ password1
, assword1
, p.assword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 126 | ≈6.9B · <1 s | Medium |
| 193 |
toggles2.rule
|
Pure case-toggling: flips letter case at fixed positions to cover CamelCase/StUdLy spellings. Mostly flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ password1
.
|
Case-sensitive targets — NTLM/AD and any dump where only capitalization varies. Pair with a list already close to the target (e.g. cracked founds). | 120 | ≈6.6B · <1 s | Medium |
| 194 |
emails.rule
|
Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end. e.g. Password1
→ Password1@gmail.com
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 100 | ≈5.5B · <1 s | Medium |
| 195 |
HashMob._100.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, reverses, duplicates or reflects the word. e.g. Password1
→ Psword1111
, password1
, Passwor1
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 100 | ≈5.5B · <1 s | Medium |
| 196 |
UnicornSmol.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly tacks digits onto the end (years, 1, 123…); also reshuffles characters or uses positional swap/memory ops, trims or deletes characters from the word. e.g. Password1
→ Password11
, Oassword1
, Password
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 100 | ≈5.5B · <1 s | Medium |
| 197 |
• append_ldus_passthrough.rule
• append_ldus.rule
• append_lus_passthrough.rule
• append_lus.rule
(family — 4 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly appends letters or whole words to the end; also tacks symbols onto the end (!, @, #, $…), tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1a
, Password1!
, Password10
. Differences:
members share ~85 core rules; append_ldus_passthrough.rule
adds ~11 more that tacks digits onto the end; append_ldus.rule
adds ~10 more that tacks digits onto the end; append_lus_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 85–96 | ≈5.3B · <1 s | Medium |
| 198 |
decorate.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also changes capitalization (lowercase, UPPERCASE or Capitalized), tacks symbols onto the end (!, @, #, $…). e.g. Password1
→Password13
, cat
→Cat
, Password1
→Password1!
.
|
Instant opening jab on any fast-hash dump before heavier rules. Pair with RockYou or HashMob founds. | 96 | ≈5.3B · <1 s | Medium |
| 199 |
hashcracky_100.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word. e.g. Password1
→ Password10
, assword1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 96 | ≈5.3B · <1 s | Medium |
| 200 |
• prepend_ldus_passthrough.rule
• prepend_ldus.rule
• prepend_lus_passthrough.rule
• prepend_lus.rule
(family — 4 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ aPassword1
. Differences:
members share ~85 core rules; prepend_ldus_passthrough.rule
adds ~11 more that adds characters to the front; prepend_ldus.rule
adds ~10 more that adds characters to the front; prepend_lus_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 85–96 | ≈5.3B · <1 s | Medium |
| 201 |
nyxgeek-leet.extra.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P4ssword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 95 | ≈5.2B · <1 s | Medium |
| 202 |
KoreLogicRulesReplaceNumbers.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — replace numbers. Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7) — applied only to words that pass a length/content filter. e.g. Passw0rd0
→ Passw1rd1
.
|
'word + numbers' targets (WPA &AD): replace numbers. Pair with 8+ char base words (RockYou/company terms) so WPA length ≥8 holds. | 90 | ≈5B · <1 s | Medium |
| 203 |
passphrase-rule2.rule
|
Passphrase-oriented rules (spacing, casing, joining) for multi-word inputs. Mostly tacks symbols onto the end (!, @, #, $…); also tacks digits onto the end (years, 1, 123…), overwrites characters at specific positions inside the word. e.g. Password1
→Password12015!
, Password1
→Password12015
, Passw0rd0
→P@ssw0rd0
.
|
Multi-word passphrases — best for WPA/WPA2 PSKs (8–63 chars) and disk encryption. Pair with phrase lists, song lyrics or book-text wordlists. | 81 | ≈4.5B · <1 s | Medium |
| 204 |
• skalman_small3.rule
• skalman_small2.rule
• skalmansmall.rule
(family — 3 files) |
Mostly tacks digits onto the end (years, 1, 123…); also changes capitalization (lowercase, UPPERCASE or Capitalized), flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ Password11
, password1
, pASSWORD1
. Differences:
members share ~65 core rules; skalman_small3.rule
adds ~16 more that tacks digits onto the end; skalman_small2.rule
adds ~8 more that tacks digits onto the end.
|
Quick lightweight passes and date tweaks on any dump. Pair with RockYou. | 65–81 | ≈4.5B · <1 s | Medium |
| 205 |
KoreLogicRulesPrependYears.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends years. Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 2000Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends years). Pair with company names, seasons, months and a base dictionary of leaked founds. | 80 | ≈4.4B · <1 s | Medium |
| 206 |
• best64.rule
• best66.rule
(family — 2 files) |
Hashcat's hand-tuned flagship set — the highest-hit-rate everyday mutations packed into a tiny rule count. Mostly trims or deletes characters from the word; also tacks digits onto the end (years, 1, 123…), reverses, duplicates or reflects the word. e.g. Password1
→ Passworda
, Password10
, 1drowssaP
. Differences:
members share ~66 core rules; best64.rule
adds ~11 more that trims or deletes characters from the word.
|
Universal low-cost opener for ANY target — breach dumps, WPA and AD/NTLM. Run it first, paired with RockYou or any human-password list. | 66–77 | ≈4.2B · <1 s | Medium |
| 207 |
• append_dus_passthrough.rule
• append_dus.rule
• append_us_passthrough.rule
• append_us.rule
(family — 4 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1!
, Password1A
, Password10
. Differences:
members share ~59 core rules; append_dus_passthrough.rule
adds ~11 more that tacks digits onto the end; append_dus.rule
adds ~10 more that tacks digits onto the end; append_us_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 59–70 | ≈3.9B · <1 s | Medium–Fast |
| 208 |
• append_lds_passthrough.rule
• append_lds.rule
• append_ls_passthrough.rule
• append_ls.rule
(family — 4 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1!
, Password1a
, Password10
. Differences:
members share ~59 core rules; append_lds_passthrough.rule
adds ~11 more that tacks digits onto the end; append_lds.rule
adds ~10 more that tacks digits onto the end; append_ls_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 59–70 | ≈3.9B · <1 s | Medium–Fast |
| 209 |
• prepend_dus_passthrough.rule
• prepend_dus.rule
• prepend_us_passthrough.rule
• prepend_us.rule
(family — 4 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 0Password1
. Differences:
members share ~59 core rules; prepend_dus_passthrough.rule
adds ~11 more that adds characters to the front; prepend_dus.rule
adds ~10 more that adds characters to the front; prepend_us_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 59–70 | ≈3.9B · <1 s | Medium–Fast |
| 210 |
• prepend_lds_passthrough.rule
• prepend_lds.rule
• prepend_ls_passthrough.rule
• prepend_ls.rule
(family — 4 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ aPassword1
. Differences:
members share ~59 core rules; prepend_lds_passthrough.rule
adds ~11 more that adds characters to the front; prepend_lds.rule
adds ~10 more that adds characters to the front; prepend_ls_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 59–70 | ≈3.9B · <1 s | Medium–Fast |
| 211 |
1940-2017.rule
|
Mostly tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password11950
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 68 | ≈3.7B · <1 s | Medium |
| 212 |
HashMob._66.rule
|
HashMob community rules ordered by real-world hit-rate; the number is the rule-count tier. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, reverses, duplicates or reflects the word. e.g. Password1
→ Psword1111
, password1
, Passwor1
.
|
Modern human-password coverage tuned on recent leaks; scale the tier to GPU time. Pair with HashMob founds or weakpass for dumps &NTLM. | 66 | ≈3.6B · <1 s | Medium |
| 213 |
hob064.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also tacks symbols onto the end (!, @, #, $…), swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ Password11!
, Password1!
, Passw0rd1
.
|
General human dumps — hob064 as a fast pass, d3adhob0 for depth. Pair with RockYou or founds. | 64 | ≈3.5B · <1 s | Fast |
| 214 |
• nsa64.rule
• nsa64NoOriginal.rule
(family — 2 files) |
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word. e.g. Password1
→ Password11
, Password
. Differences:
members share ~63 core rules; nsa64.rule
adds ~1 more that passes the word through unchanged.
|
Deep second-stage coverage for fast hashes (AD-NTLM audits, MD5/SHA1 dumps) after lighter rules stall. Pair with a large list (weakpass, Top2Billion); too costly for WPA. | 63–64 | ≈3.5B · <1 s | Fast |
| 215 |
Unicorn64.rule
|
A 'Unicorn' composite — a blend of several top community sets, offered in sized tiers. Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word. e.g. Password1
→ Password11
, Password
.
|
One-stop mixed mutation for fast-hash dumps &AD-NTLM; pick the tier for your budget. Pair with RockYou/weakpass. | 64 | ≈3.5B · <1 s | Fast |
| 216 |
yubaba64.rule
|
Mostly tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password11
, password1
, 1Password1
.
|
Human passwords incl. non-English and WPA-length, tuned on real leaks (Kaonashi). Pair with the Kaonashi list or a large breach-founds wordlist. | 64 | ≈3.5B · <1 s | Fast |
| 217 |
• append_ldu_passthrough.rule
• append_ldu.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly appends letters or whole words to the end; also tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1a
, Password10
. Differences:
members share ~62 core rules; append_ldu_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 62–63 | ≈3.5B · <1 s | Fast |
| 218 |
• prepend_ldu_passthrough.rule
• prepend_ldu.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ aPassword1
. Differences:
members share ~62 core rules; prepend_ldu_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 62–63 | ≈3.5B · <1 s | Fast |
| 219 |
blandyuk_accent_rep.rule
|
Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ Pàssword1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 60 | ≈3.3B · <1 s | Fast |
| 220 |
stacking58.rule
|
Mostly adds characters to the front (1word, !word…); also tacks symbols onto the end (!, @, #, $…), tacks digits onto the end (years, 1, 123…). e.g. Password1
→ 0Password1
, Password1!
, Password10
.
|
Instant opening jab on any fast-hash dump before heavier rules. Pair with RockYou or HashMob founds. | 58 | ≈3.2B · <1 s | Fast |
| 221 |
• append_lu_passthrough.rule
• append_lu.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly appends letters or whole words to the end. e.g. Password1
→ Password1a
. Differences:
members share ~52 core rules; append_lu_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 52–53 | ≈2.9B · <1 s | Fast |
| 222 |
appendYear.rule
|
Mostly tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password11970
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 53 | ≈2.9B · <1 s | Fast |
| 223 |
• prepend_lu_passthrough.rule
• prepend_lu.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ aPassword1
. Differences:
members share ~52 core rules; prepend_lu_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 52–53 | ≈2.9B · <1 s | Fast |
| 224 |
nyxgeek-emails.rule
|
A nyxgeek set aimed at usernames/emails and light mutations, handy for cloud (O365/Azure) spraying lists. Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end, changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ Password1@gmail.com
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 52 | ≈2.9B · <1 s | Fast |
| 225 |
combinator.rule
|
Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also inserts characters at specific positions inside the word, tacks digits onto the end (years, 1, 123…). e.g. Password1
→ password1
, pas sword1
, password11
.
|
Helper for combinator attacks (joining two wordlists, word+word). Pair two dictionaries such as names + common words. | 51 | ≈2.8B · <1 s | Fast |
| 226 |
ProbWL-51-rule-probable-v2.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word. e.g. Password1
→ Password11
, Password
.
|
General human passwords — designed to pair with the Probable-Wordlists dictionaries (Top-x-probable). | 51 | ≈2.8B · <1 s | Fast |
| 227 |
nyxgeek-leet.multi.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P@ssword1
.
|
Not hash mutation — builds usernames/emails for password-spraying O365/Azure/AD logins. Pair with first- and last-name lists. | 49 | ≈2.7B · <1 s | Fast |
| 228 |
hashcracky_50.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ Password10
, assword1
, password1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 46 | ≈2.5B · <1 s | Fast |
| 229 |
• append_ds_passthrough.rule
• append_ds.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks symbols onto the end (!, @, #, $…); also tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1!
, Password10
. Differences:
members share ~43 core rules; append_ds_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 43–44 | ≈2.4B · <1 s | Fast |
| 230 |
• prepend_ds_passthrough.rule
• prepend_ds.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 0Password1
. Differences:
members share ~43 core rules; prepend_ds_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 43–44 | ≈2.4B · <1 s | Fast |
| 231 |
KoreLogicRulesAppendCurrentYearSpecial.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends current year special. Mostly tacks digits onto the end (years, 1, 123…); also tacks symbols onto the end (!, @, #, $…), changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ Password12010!
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends current year special). Pair with company names, seasons, months and a base dictionary of leaked founds. | 38 | ≈2.1B · <1 s | Fast |
| 232 |
• append_du_passthrough.rule
• append_du.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly appends letters or whole words to the end; also tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1A
, Password10
. Differences:
members share ~36 core rules; append_du_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 36–37 | ≈2B · <1 s | Fast |
| 233 |
• append_ld_passthrough.rule
• append_ld.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly appends letters or whole words to the end; also tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1a
, Password10
. Differences:
members share ~36 core rules; append_ld_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 36–37 | ≈2B · <1 s | Fast |
| 234 |
• prepend_du_passthrough.rule
• prepend_du.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 0Password1
. Differences:
members share ~36 core rules; prepend_du_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 36–37 | ≈2B · <1 s | Fast |
| 235 |
• prepend_ld_passthrough.rule
• prepend_ld.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ aPassword1
. Differences:
members share ~36 core rules; prepend_ld_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 36–37 | ≈2B · <1 s | Fast |
| 236 |
append.!@34.rule
|
Mostly tacks symbols onto the end (!, @, #, $…); also tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password1!
, Password1!@12
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 36 | ≈2B · <1 s | Fast |
| 237 |
KoreLogicRulesAppend1_AddSpecialEverywhere.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends 1 add special everywhere. Mostly inserts characters at specific positions inside the word; also changes capitalization (lowercase, UPPERCASE or Capitalized), tacks digits onto the end (years, 1, 123…) — applied only to words that pass a length/content filter. e.g. Password1
→ !Password11
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends 1 add special everywhere). Pair with company names, seasons, months and a base dictionary of leaked founds. | 36 | ≈2B · <1 s | Fast |
| 238 |
• append_s_passthrough.rule
• append_s.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password1!
. Differences:
members share ~33 core rules; append_s_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 33–34 | ≈1.9B · <1 s | Fast |
| 239 |
• prepend_s_passthrough.rule
• prepend_s.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ !Password1
. Differences:
members share ~33 core rules; prepend_s_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 33–34 | ≈1.9B · <1 s | Fast |
| 240 |
hashcracky_post_process.rule
|
Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7); also tacks symbols onto the end (!, @, #, $…), adds characters to the front (1word, !word…). e.g. Password1
→ P@ssword1
, !Password1!
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 33 | ≈1.8B · <1 s | Fast |
| 241 |
KoreLogicRulesPrependHello.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends hello. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ helloPassword1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends hello). Pair with company names, seasons, months and a base dictionary of leaked founds. | 32 | ≈1.8B · <1 s | Fast |
| 242 |
T0XlC_3_rule.rule
|
A T0XlC set that injects tokens (years, specials, top passwords) *inside* words at many positions. Mostly flips the case of individual letters (CamelCase / StUdLy variants); also reshuffles characters or uses positional swap/memory ops. e.g. Password1
→ PAssword1
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 30 | ≈1.6B · <1 s | Fast |
| 243 |
• append_l_passthrough.rule
• append_l.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly appends letters or whole words to the end. e.g. Password1
→ Password1a
. Differences:
members share ~26 core rules; append_l_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 26–27 | ≈1.5B · <1 s | Fast |
| 244 |
• append_u_passthrough.rule
• append_u.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly appends letters or whole words to the end. e.g. Password1
→ Password1A
. Differences:
members share ~26 core rules; append_u_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 26–27 | ≈1.5B · <1 s | Fast |
| 245 |
• prepend_l_passthrough.rule
• prepend_l.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ aPassword1
. Differences:
members share ~26 core rules; prepend_l_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 26–27 | ≈1.5B · <1 s | Fast |
| 246 |
• prepend_u_passthrough.rule
• prepend_u.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ APassword1
. Differences:
members share ~26 core rules; prepend_u_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 26–27 | ≈1.5B · <1 s | Fast |
| 247 |
KoreLogicRulesAppendMonthCurrentYear.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — appends month current year. Mostly tacks digits onto the end (years, 1, 123…); also appends letters or whole words to the end. e.g. Password1
→ Password1jan2010
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — appends month current year). Pair with company names, seasons, months and a base dictionary of leaked founds. | 26 | ≈1.4B · <1 s | Fast |
| 248 |
KoreLogicRulesReplaceLettersCaps.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — replace letters capitals. Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7) — applied only to words that pass a length/content filter. e.g. Password1
→ PAssword1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 26 | ≈1.4B · <1 s | Fast |
| 249 |
ProbWL-26-rule-probable-v2.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also trims or deletes characters from the word, tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password11
, Password
, Password1!
.
|
General human passwords — designed to pair with the Probable-Wordlists dictionaries (Top-x-probable). | 26 | ≈1.4B · <1 s | Fast |
| 250 |
KoreLogicRulesMonthsFullPreface.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — months full preface. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ januaryPassword1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — months full preface). Pair with company names, seasons, months and a base dictionary of leaked founds. | 24 | ≈1.3B · <1 s | Fast |
| 251 |
blandyuk_prepend_sym.rule
|
Mostly adds characters to the front (1word, !word…). e.g. Password1
→ !Password1
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 22 | ≈1.2B · <1 s | Fast |
| 252 |
Combined-leetspeak.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P455w02d1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 22 | ≈1.2B · <1 s | Fast |
| 253 |
KoreLogicRulesPrepend4LetterMonths.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends 4 letter months. Mostly adds characters to the front (1word, !word…). e.g. Password1
→ marcPassword1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends 4 letter months). Pair with company names, seasons, months and a base dictionary of leaked founds. | 22 | ≈1.2B · <1 s | Fast |
| 254 |
clem9669_case.rule
|
Mostly flips the case of individual letters (CamelCase / StUdLy variants); also changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ pASSWORD1
, password1
.
|
General human passwords incl. French/accented and emoji — fine for dumps and WPA. Pair with a multilingual or RockYou-style list. | 20 | ≈1.1B · <1 s | Fast |
| 255 |
• append_hl_passthrough.rule
• append_hl.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks digits onto the end (years, 1, 123…); also appends letters or whole words to the end. e.g. Password1
→ Password10
, Password1a
. Differences:
members share ~16 core rules; append_hl_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 16–17 | ≈935M · <1 s | Fast |
| 256 |
• append_hu_passthrough.rule
• append_hu.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks digits onto the end (years, 1, 123…); also appends letters or whole words to the end. e.g. Password1
→ Password10
, Password1A
. Differences:
members share ~16 core rules; append_hu_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 16–17 | ≈935M · <1 s | Fast |
| 257 |
leetspeak.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P4ssword1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 17 | ≈935M · <1 s | Fast |
| 258 |
• prepend_hl_passthrough.rule
• prepend_hl.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 0Password1
. Differences:
members share ~16 core rules; prepend_hl_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 16–17 | ≈935M · <1 s | Fast |
| 259 |
• prepend_hu_passthrough.rule
• prepend_hu.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 0Password1
. Differences:
members share ~16 core rules; prepend_hu_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 16–17 | ≈935M · <1 s | Fast |
| 260 |
passphrase-rule1.rule
|
Passphrase-oriented rules (spacing, casing, joining) for multi-word inputs. Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7); also changes capitalization (lowercase, UPPERCASE or Capitalized), strips out chosen characters. e.g. cat
→Cat
, Password1
→pASSWORD1
.
|
Multi-word passphrases — best for WPA/WPA2 PSKs (8–63 chars) and disk encryption. Pair with phrase lists, song lyrics or book-text wordlists. | 16 | ≈880M · <1 s | Fast |
| 261 |
hashcracky_short_15.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password11
, Password1!1
.
|
General human dumps (sized tiers) plus affix-specific runs. Pair with RockYou or HashMob founds. | 15 | ≈825M · <1 s | Fast |
| 262 |
KoreLogicRulesPrependSeason.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — prepends season. Mostly adds characters to the front (1word, !word…). e.g. Password1
→ springPassword1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — prepends season). Pair with company names, seasons, months and a base dictionary of leaked founds. | 15 | ≈825M · <1 s | Fast |
| 263 |
toggles1.rule
|
Pure case-toggling: flips letter case at fixed positions to cover CamelCase/StUdLy spellings. Mostly flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ password1
.
|
Case-sensitive targets — NTLM/AD and any dump where only capitalization varies. Pair with a list already close to the target (e.g. cracked founds). | 15 | ≈825M · <1 s | Fast |
| 264 |
rot13.rule
|
Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ Paaaaaaa1
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 13 | ≈715M · <1 s | Fast |
| 265 |
append_separators.rule
|
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password1-
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 12 | ≈660M · <1 s | Fast |
| 266 |
KoreLogicRulesDevProdTestUAT.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — dev prod test uat. Mostly inserts characters at specific positions inside the word; also appends letters or whole words to the end. e.g. Password1
→ devPassword1
, Password1dev
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — dev prod test uat). Pair with company names, seasons, months and a base dictionary of leaked founds. | 12 | ≈660M · <1 s | Fast |
| 267 |
• append_d_passthrough.rule
• append_d.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password10
. Differences:
members share ~10 core rules; append_d_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 10–11 | ≈605M · <1 s | Fast |
| 268 |
KoreLogicRulesAddOnes.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — add ones. Mostly tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password11
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — add ones). Pair with company names, seasons, months and a base dictionary of leaked founds. | 11 | ≈605M · <1 s | Fast |
| 269 |
• prepend_d_passthrough.rule
• prepend_d.rule
(family — 2 files) |
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly adds characters to the front (1word, !word…). e.g. Password1
→ 0Password1
. Differences:
members share ~10 core rules; prepend_d_passthrough.rule
adds ~1 more that passes the word through unchanged.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 10–11 | ≈605M · <1 s | Fast |
| 270 |
Robot-Best10.rule
|
Mostly adds characters to the front (1word, !word…); also tacks symbols onto the end (!, @, #, $…), trims or deletes characters from the word. e.g. Password1
→ e8Password1
, Password0
.
|
General fast-hash cracking incl. reversed-guess passes. Pair with RockYou or HashMob founds. | 11 | ≈605M · <1 s | Fast |
| 271 |
KoreLogicRulesReplaceNumbers2Special.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — replace numbers 2 special. Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7) — applied only to words that pass a length/content filter. e.g. Password1
→ Password!
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — replace numbers 2 special). Pair with company names, seasons, months and a base dictionary of leaked founds. | 10 | ≈550M · <1 s | Fast |
| 272 |
top10_2025.rule
|
Mostly tacks digits onto the end (years, 1, 123…); also changes capitalization (lowercase, UPPERCASE or Capitalized), tacks symbols onto the end (!, @, #, $…). e.g. Password1
→Password11
, cat
→Cat
, Password1
→Password1!
.
|
Instant opening jab on any fast-hash dump before heavier rules. Pair with RockYou or HashMob founds. | 10 | ≈550M · <1 s | Fast |
| 273 |
• blandyuk_basic.rule
• blandyuk_basicNoOriginal.rule
(family — 2 files) |
Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also reverses, duplicates or reflects the word, flips the case of individual letters (CamelCase / StUdLy variants). e.g. Password1
→ password1
, Password1Password1
, pASSWORD1
. Differences:
members share ~7 core rules; blandyuk_basic.rule
adds ~1 more that passes the word through unchanged.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 7–8 | ≈440M · <1 s | Fast |
| 274 |
append_sym.rule
|
A hybrid-style set: bolts short brute-force character-class segments onto each word (like a mask, but as rules). Mostly tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password1!
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 7 | ≈385M · <1 s | Fast |
| 275 |
blandyuk_facebook.rule
|
Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→password1
, Passw0rd0
→passw0rd0
.
|
Structured position-based mutations for fast-hash dumps. Pair with RockYou; match the variant to your target's shape. | 7 | ≈385M · <1 s | Fast |
| 276 |
KoreLogicRulesAdd1234_Everywhere.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — add 1234 everywhere. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 1234Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — add 1234 everywhere). Pair with company names, seasons, months and a base dictionary of leaked founds. | 7 | ≈385M · <1 s | Fast |
| 277 |
KoreLogicRulesAdd2006Everywhere.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — add 2006 everywhere. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 2006Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — add 2006 everywhere). Pair with company names, seasons, months and a base dictionary of leaked founds. | 7 | ≈385M · <1 s | Fast |
| 278 |
KoreLogicRulesAdd2010Everywhere.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — add 2010 everywhere. Mostly inserts characters at specific positions inside the word. e.g. Password1
→ 2010Password1
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — add 2010 everywhere). Pair with company names, seasons, months and a base dictionary of leaked founds. | 7 | ≈385M · <1 s | Fast |
| 279 |
KoreLogicRulesAddDotCom.rule
|
KoreLogic DEF CON 'Crack Me If You Can' rule — add dot com. Mostly tacks symbols onto the end (!, @, #, $…); also appends letters or whole words to the end, changes capitalization (lowercase, UPPERCASE or Capitalized). e.g. Password1
→ Password1.com
.
|
Enterprise / AD-NTLM patterns (DEF CON contest — add dot com). Pair with company names, seasons, months and a base dictionary of leaked founds. | 6 | ≈330M · <1 s | Fast |
| 280 |
Shooter-LeetSpeak-With-Passthrough.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P455w02d1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 6 | ≈330M · <1 s | Fast |
| 281 |
Shooter-LeetSpeak.rule
|
a leetspeak set that swaps letters for look-alike numbers/symbols (e→3, a→@/4, o→0, s→$). Mostly swaps letters for look-alike numbers/symbols — leetspeak (a→@/4, e→3, i→1, o→0, s→$/5, t→7). e.g. Password1
→ P455w02d1
.
|
Passwords using symbol swaps (p@ssw0rd, l33t) across dumps, WPA and AD/NTLM. Pair with a plain dictionary of real words/names so the swaps land. | 5 | ≈275M · <1 s | Fast |
| 282 |
tiny.rule
|
Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also trims or deletes characters from the word. e.g. Password1
→ password1
, Password
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 4 | ≈220M · <1 s | Fast |
| 283 |
append.!!.rule
|
Mostly tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password1!!
.
|
The 'word + digits/year/symbol' pattern that dominates WPA &AD passwords (Summer2024!, router07). Keep 8+ char base words for WPA; pair with RockYou or company terms. | 2 | ≈110M · <1 s | Fast |
| 284 |
8track.rule
|
Mostly tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password1--
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 1 | ≈55M · <1 s | Fast |
| 285 |
Chatbooks.rule
|
Mostly tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password1:
.
|
Application/format-specific tweaks — use against that specific target. Pair with a general or app-themed list. | 1 | ≈55M · <1 s | Fast |
| 286 |
descrypt.rule
|
Mostly trims or deletes characters from the word. e.g. Password1
→ Password
.
|
Legacy Unix DES crypt(3), 8-char max — truncates candidates to fit. Pair with an older/general password list. | 1 | ≈55M · <1 s | Fast |
| 287 |
n.rule
|
Mostly appends letters or whole words to the end; also adds characters to the front (1word, !word…). e.g. Password1
→ nPassword1n
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 1 | ≈55M · <1 s | Fast |
| 288 |
pepper.rule
|
Mostly tacks digits onto the end (years, 1, 123…). e.g. Password1
→ Password12147483647
.
|
General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 1 | ≈55M · <1 s | Fast |
| 289 |
reject.rule
|
Mostly filters out candidates that fail a length/content test. | Keyspace trimming — filters candidates by length/content (e.g. drop <8 chars for WPA). Stack on top of another rule. | 1 | ≈55M · <1 s | Fast |
| 290 |
SHA1Dash.rule
|
Mostly tacks symbols onto the end (!, @, #, $…). e.g. Password1
→ Password1--
.
|
Application/format-specific tweaks — use against that specific target. Pair with a general or app-themed list. | 1 | ≈55M · <1 s | Fast |
| 291 |
test.rule
|
Mostly trims or deletes characters from the word. | General human-password dumps on fast hashes (NTLM/MD5/SHA1). Pair with RockYou or weakpass. | 1 | ≈55M · <1 s | Fast |
| 292 |
uppercase.rule
|
Mostly changes capitalization (lowercase, UPPERCASE or Capitalized); also adds characters to the front (1word, !word…). e.g. Password1
→ :PASSWORD1
.
|
Upper-cases words — case-insensitive stores or LM-style targets. Pair with any list. | 1 | ≈55M · <1 s | Fast |
| 293 |
Fordyv4a.rule
|
⚠️ Git-LFS pointer — the actual rule file is not present in this checkout
(run git lfs pull
to fetch it). Judging by the family, a large statistically-generated Fordy leetspeak/mutation set.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | N/A | N/A (not downloaded) | — (LFS) |
| 294 |
Fordyv4b.rule
|
⚠️ Git-LFS pointer — the actual rule file is not present in this checkout
(run git lfs pull
to fetch it). Judging by the family, a large statistically-generated Fordy leetspeak/mutation set.
|
Broad general coverage for fast-hash human dumps; scale the tier to GPU time. Pair with RockYou or weakpass. | N/A | N/A (not downloaded) | — (LFS) |
Speed bands: Fast ≤64 · Medium 65–5k · Slow 5k–100k · Insane >100k rules. Wall-clock is illustrative for a fast hash; slow hashes (bcrypt/WPA) scale to days–years — divide your real hashrate into the candidate count. Rule files were not modified.