PassGAN is an open-source research implementation of a deep-learning approach to password guessing: instead of hand-written rules and mangling dictionaries, a generative adversarial network learns the distribution of real passwords from leaked datasets and generates new, high-quality guesses. This repository, by Brannondorsey, packages the PassGAN paper’s approach (built on Improved Wasserstein GAN training) into an easy train.py and sample.py command-line workflow and includes a model pretrained on the RockYou dataset. It has around 2,000 GitHub stars; the code dates from the original research era and was last updated in 2023.
Traditional password crackers like HashCat and John the Ripper rely on human-crafted rules to transform dictionary words. PassGAN showed a GAN can learn those patterns itself: trained on millions of leaked passwords, it generates candidate passwords that match human choices at rates competitive with rule-based tools, and its performance keeps improving with training. The repo is explicit about its research purpose and is a standard reference for ML-based password-guessing studies and defensive password-strength research.
Free. PassGAN is open source under the MIT license for research and defensive security use.
Security researchers studying password strength, authentication designers evaluating guessing resistance, and ML students who want a compact, real-world GAN application to learn from.
PassGAN’s results helped kick off a line of research into neural password modeling that includes recurrent and transformer-based successors, and its generated guesses are still used as a baseline in academic comparisons. Defensively, the same models inform modern password-strength meters and breach-corpus screening: if a GAN trained on public leaks can generate a candidate quickly, that password should not protect anything important, which is exactly the kind of evidence PassGAN was built to provide.