PML-6L

PML-6L -- Password Modeling Language

This repository contains a password modeling language trained from scratch on 13 million real-world passwords. Built on a LLaMA-style architecture (RoPE + SwiGLU + RMSNorm) with only 11M parameters, it learns the statistical structure of human-created passwords and can generate realistic candidates for authorized security testing.

Architecture

Training Data

Train/validation split is disjoint -- no password appears in both sets. Passwords are filtered to 4-24 characters, printable ASCII only.

Evaluation

The model is evaluated using hashcat v7.1.2 (RTX 4060, 27.5 GH/s MD5). Target: hashkiller.dic (23.7M passwords, MD5 hashed). We generate 5,000 passwords per shot across 5 temperatures, 5 presets, and 4 epochs (100 shots total). Three rule sets show how rules amplify cracking power:

For RAW and LIGHT, per-shot stats come from hashcat --stdout + potfile matching. FULL per-shot is proportionally scaled from LIGHT.

Overall Results

Detailed RAW Results (Best Preset: L8_MIXED)

Winners by Preset

RAW (Direct Match)

LIGHT (500 Rules) / FULL (52K Rules)

With rule application, most presets saturate near 100% coverage per shot:

Temperature Sensitivity

Lower temperatures produce more common (higher-probability) passwords, resulting in more direct matches in the target dictionary. Higher temperatures increase diversity at the cost of raw hit rate.

Recommended configuration: Temperature 0.6 for best balance of hit rate and diversity (0% duplicate rate). Temperature 0.2 for maximum raw crack count.

Training Configuration

Loss Progression

Best checkpoint: Epoch 3 (lowest validation loss). Overfitting begins at epoch 4, indicated by the first val loss increase.

Generation Samples

Temperature Sweep ([LEN:12][CHARS:ALL] tag)

Conditional Generation

The model supports tag-based conditional generation for targeted password candidates:

# Plain generation (no tag)
>>> model.generate(tokenizer, temperature=0.6)
"iloveyou123"

# 8-character alphanumeric password
>>> prefix = tokenizer.encode("[LEN:8][CHARS:ALPHANUM]:").ids
>>> model.generate(tokenizer, temperature=0.6, prefix_ids=prefix)
"Johnny19"

# 12-character mixed password (letters + numbers + specials)
>>> prefix = tokenizer.encode("[LEN:12][CHARS:ALL]:").ids
>>> model.generate(tokenizer, temperature=0.8, prefix_ids=prefix)
"Angel_2000!"

# 6-character alphabetic (lowercase only)
>>> prefix = tokenizer.encode("[LEN:6][CHARS:ALPHA]:").ids
>>> model.generate(tokenizer, temperature=0.4, prefix_ids=prefix)
"dabook"

Expected Output by Temperature

Usage

Installation

pip install torch tokenizers

Load Model

import torch
from tokenizers import Tokenizer
from model_v2 import LLaMAModel

device = "cuda" if torch.cuda.is_available() else "cpu"

tokenizer = Tokenizer.from_file("tokenizer.json")
model = LLaMAModel.from_pretrained("K0D3IN/PML-6L").to(device)
model.eval()

Generate Passwords

def generate(model, tokenizer, temperature=0.6, tag=None, n=10):
    prefix_ids = tokenizer.encode(tag).ids if tag else None
    pws = set()
    while len(pws) < n:
        pw = model.generate(
            tokenizer,
            temperature=temperature,
            top_k=50,
            max_len=24,
            min_len=4,
            prefix_ids=prefix_ids,
            device=device,
        )
        if pw:
            pws.add(pw)
    return list(pws)

# Generate 50 passwords for security testing
passwords = generate(model, tokenizer, temperature=0.6, n=50)

Training Details

This model was trained on an NVIDIA GeForce RTX 4060 Laptop GPU (8GB VRAM) using PyTorch 2.11 with CUDA 13.2.

Architecture Diagram (Simplified)

Input IDs → Embedding (vocab=500 → dim=384)
          → RoPE Position Encoding
          → 6× Block:
              ├── RMSNorm
              ├── Causal Self-Attention (6 heads, FlashAttention)
              ├── RMSNorm
              └── SwiGLU MLP (384 → 1024 → 384)
          → RMSNorm
          → LM Head (384 → vocab=500)
          → Logits

Intended Use

Ethical Notice

This model generates password candidates that may match real user credentials.

Passwords generated by this model are statistical patterns derived from public breach data (rockyou.txt and sqlmap.txt). They do not contain actual user credentials from the training set. However, due to the nature of password generation, some outputs may coincidentally match real passwords currently in use.

Users are solely responsible for:

• Obtaining proper authorization before any security testing
• Complying with all applicable laws (CFAA, GDPR, KVKK, etc.)
• Ensuring testing is conducted within authorized scope only
• Secure handling and disposal of generated password lists

This model should NOT be used for:

• Any illegal activity
• Attacking systems without explicit written permission
• Mass credential stuffing or account takeover attempts
• Harassing individuals or organizations

Files

Citation

@software{PML-6L,
  author = {K0D3IN},
  title = {PML-6L: Password Pattern Generator},
  year = {2026},
  url = {https://huggingface.co/K0D3IN/PML-6L}
}

License

This project is licensed under the MIT License -- see the LICENSE file for details.

Support Open Source AI Research

Every donation helps maintain and improve this project:

Monero (XMR):

83iqXtvVu28ZiL9bsATMerSgbFFiD1J1jc96CcxJLEnAW3KBmBKedWnUAeLvLvEA9aBiUBpHQJs1iNHYtkTLZbNUEymobSS

Bitcoin (BTC):

bc1qmnlvpukcgl0hsr7nje0x8555mhtxjt80wtmlxm