README

p4ssw0rd analyzes the given password, and gives a worst-case time to crack based
on known mutations used by password crackers and recovery software.

A basic demo is online at: http://www.2kx2k.com/p4ssw0rd

This is intended to check against offline attacks in a typical situation, where
passwords are salted and hashed with SHA-1 a single time. Crack time is based
on online (1,000 guesses per second) and offline (1,000,000,000 guesses per
second - a single modern GPU).

Entropy is not considered, since this is doing full dictionary attack simulation.

"Random Password" functionality requires a password list - just put it in the
root directory as "random.txt". The demo uses the entire RockYou password leak.

Key graphs are based on concepts from Dan Wheeler's zxcvbn, which is one of the
best client-side password analyzers out there. https://github.com/lowe/zxcvbn

Password lists:
ftp://ftp.openwall.com/pub/wordlists/
http://www.skullsecurity.org/wiki/index.php/Passwords
http://en.wiktionary.org/wiki/Wiktionary:Frequency_lists
http://contest-2010.korelogic.com/wordlists.html

Theory:
http://www.troyhunt.com/2011/07/science-of-password-selection.html

Common mutations for recovery software:
http://blog.crackpassword.com/2009/04/smart-password-mutations-explained/
http://www.elcomsoft.com/help/ewsa/index.html?dictionary_mutations.html
http://www.passcape.com/windows_password_recovery_dictionary_attack
http://contest-2010.korelogic.com/rules.html