Large language models (LLMs) successfully model natural language from vast
amounts of text without the need for explicit supervision. In this paper, we
investigate the efficacy of LLMs in modeling passwords. We present PassGPT, a
LLM trained on password leaks for password generation. PassGPT outperforms
existing methods based on generative adversarial networks (GAN) by guessing
twice as many previously unseen passwords. Furthermore, we introduce the
concept of guided password generation, where we leverage PassGPT sampling
procedure to generate passwords matching arbitrary constraints, a feat lacking
in current GAN-based strategies. Lastly, we conduct an in-depth analysis of the
entropy and probability distribution that PassGPT defines over passwords and
discuss their use in enhancing existing password strength estimators.

本篇论文研究了大型语言模型在密码建模中的效力，介绍了一种名为 PassGPT 的大型语言模型，并在密码生成中表现出众，比起之前基于生成对抗网络的方法，猜对了两倍数量的新密码，同时，文章提出了引导密码生成的概念，利用 PassGPT 采样过程生成符合任意约束的密码。最后，文章对 PassGPT 定义密码的熵和概率分布进行了深入分析，并讨论其在增强现有密码强度评估器方面的应用。