What is a password wordlist?

A password wordlist is a text file containing a collection of passwords or password candidates, commonly used in security testing, password analysis and research.

What are mask patterns?

Mask patterns use placeholders such as ?u for uppercase, ?l for lowercase and ?d for digits to define password structures. For example, ?u?l?l?d?d generates passwords like Abc12.

Can I download the generated wordlist?

Yes. After generation is complete you can download the generated password wordlist as a standard text file compatible with tools like Hashcat.

Is this tool free to use?

Yes, the Password Generator is completely free to use with no hidden charges or subscriptions.

How is this tool useful for security professionals?

Security professionals can use this tool to generate custom, Hashcat-compatible password wordlists for password auditing, penetration testing, security assessments and compliance testing, with full control over patterns and transformations.

Password Generator

Configuration

Max Password Length Maximum length for generated passwords (1-128 characters). Output Delimiter Separator between passwords. Use \n for newline, \t for tab.

Advanced Settings

ASCII Only Mode When enabled, rejects non-ASCII characters in wordlists and masks. Disable for international character support. Batch Size Number of passwords processed per iteration. Higher values = faster generation but more memory usage.

Source Mode

Wordlist Mask Builder

Wordlist Source

Upload Wordlist File Plain text file with one password per line (.txt, .list, .dic).

Or Enter Manually Type or paste passwords, one per line.

Wordlist Options

Skip First N Entries Skip this many passwords from the start of the wordlist. Limit to N Entries Process at most this many passwords (leave empty for all). Remove Duplicates Automatically filter out repeated entries.

Mask Builder

Mask Pattern Use placeholders like ?l (lowercase), ?u (uppercase), ?d (digit), ?s (special), ?a (any printable). Wrap literal blocks in braces to keep them constant (e.g., ?d{2024}?u). Example: ?u?l?l?l?d?d?d = Abcd123

📖 Mask Placeholder Reference

Mask placeholders define which characters can appear at each position. Combine them to create complex password patterns.

?l Lowercase letters (a-z) Example: ?l?l?l → abc, xyz, dog

?u Uppercase letters (A-Z) Example: ?u?u?u → ABC, XYZ, DOG

?d Digits (0-9) Example: ?d?d?d?d → 0000, 1234, 9999

?s Special characters (!@#$%^&*...) Example: ?s?s → !@, #$, *&

?a All printable ASCII (letters, digits, special) Example: ?a?a → aZ, 1!, @#

?h Lowercase hexadecimal (0-9a-f) Example: ?h?h?h → 0a1, fff, c3e

?H Uppercase hexadecimal (0-9A-F) Example: ?H?H?H → 0A1, FFF, C3E

?1-?4 Custom character sets (define in Advanced Options below) Example: ?1?1?1 where ?1=abc → aaa, abc, ccc

{literal} Constant string inserted verbatim without consuming mask slots Example: ?d{XYZ}?u → 0XYZA, 1XYZB, 9XYZC

💡 Tip: Combine placeholders and constant blocks for realistic patterns! ?u{2024}?l?l?d generates passwords like "P2024as5", "R2024ed7", etc.

Min Length Minimum password length to generate. Max Length Maximum password length to generate.

Advanced Mask Options

Incremental Mode Generate passwords starting from minimum length up to maximum length.

Skip First N Skip this many combinations from the start. Limit to N Generate at most this many passwords (leave empty for all).

Auto-deduplicate Automatically enabled. Ensures consistent output order.

Custom Character Sets (?1-?4)

Define up to 4 custom character sets to use in your mask with ?1, ?2, ?3, ?4.

?1 Custom Charset ?2 Custom Charset ?3 Custom Charset ?4 Custom Charset

Transformation Rules

Apply rules to transform generated passwords. Rules marked as incompatible will automatically disable each other.

📖 Transformation Rules Guide

Transformation rules modify passwords according to Hashcat rule syntax. Use them to create password variations automatically.

Case Transformation

Uppercase: Converts all letters to UPPERCASE

password → PASSWORD

Lowercase: Converts all letters to lowercase

PASSWORD → password

Capitalize: First letter uppercase, rest lowercase

password → Password

Toggle Case: Inverts the case of every letter

Password → pASSWORD

String Manipulation

Reverse: Reverses the entire password

password → drowssap

Duplicate: Repeats the password twice

password → passwordpassword

Reflect: Appends the password in reverse

password → passworddrowssap

Character Substitution

Leetspeak: Replaces letters with similar-looking numbers and symbols

password → p@55w0rd

Common mappings: a→@, e→3, i→1, o→0, s→5, t→7

Custom Transformations

Prepend: Add custom text at the beginning

Input "admin_" → admin_password

Append: Add custom text at the end

Input "123" → password123

⚠️ Rule Compatibility: Case transformation rules (Uppercase, Lowercase, Capitalize, Toggle Case) are mutually exclusive. Selecting one will automatically deselect others.

Custom Transformations

Prepend Text Add text at the beginning of each password (e.g., "admin_" → admin_password). Append Text Add text at the end of each password (e.g., "123" → password123).

Password Generator

User Guide

How to Use:

Key Features:

Configuration

Source Mode

Wordlist Source

Mask Builder

Transformation Rules

Custom Transformations

Preset Rules

Generate Wordlist

Generate Powerful Password Wordlists

Why Use Our Password Generator?

Online Password Wordlist Generator - Create Custom Hashcat Wordlists

What Can You Generate?

How to Use Our Password Generator

Understanding Mask Patterns

Why Generate Password Wordlists?

Privacy & Security

Common Questions About Password Wordlists

Start Generating Password Wordlists Now

Frequently Asked Questions (FAQ)

What is a password wordlist?

What are mask patterns?

Can I download the generated wordlist?

Is this tool free to use?

How is this tool useful for security professionals?

Help us keep Tools For All free