Evaluating the Efficacy of GPT-based Password Generation on Real World Data

Passwords remain a dominant something-you-know authentication method, valued for their simplicity and ubiquity despite advancements in alternative technologies. However, predictable patterns in user-generated passwords continue to expose vulnerabilities, highlighting the need for ongoing research into password security. Traditional rule-based password generation tools, such as HashCat, utilize predefined patterns to create new password candidates. While effective in certain contexts, these approaches struggle to generalize beyond their programmed rules. In contrast, GPT-based models can learn nuanced patterns in real-world datasets, offering a more flexible and potentially powerful alternative. Therefore, this study explores the efficacy of GPT-based models for password generation and their potential to enhance password security research by addressing three critical areas: password guessing, password generation, and password strength evaluation. Specifically, we address the following questions: (1) How effectively can GPT-based models capture the characteristics of real-world datasets in terms of password strength? (2) How do training datasets influence the password guessing accuracy of language models? (3) Do GPTbased tools outperform traditional rule-based approaches like HashCat? Our findings reveal that GPT-based techniques effectively capture the underlying characteristics of training datasets. However, their ability to replicate human behavior in generating high-strength passwords remains limited. Consequently, further research incorporating real-world compromised passwords from data breaches is essential to enhance their effectiveness.