article · Journal of applied science and environmental management
An evaluation of fourteen million user-generated passwords reveals significant vulnerabilities when tested against modern artificial intelligence cracking tools such as PassGAN. Over eighty-one percent of reviewed credentials failed to satisfy twelve-character minimum length recommendations, exhibiting a median length of only nine characters. Predictable keyboard patterns appeared in nearly thirty percent of passwords, while forty-four percent relied on simplistic character substitutions that satisfy basic complexity rules without providing genuine security. Furthermore, credentials complying with standard guidelines were breached over twenty-four percent faster by artificial intelligence tools compared with traditional brute-force attacks. To counter these vulnerabilities, security strategies should prioritise password length and breach-derived blocklists over arbitrary character rules, alongside adopting advanced authentication standards. An open-source analysis framework provides automated tools to assess password strength and policy alignment directly.
Conventional password rules often prompt users to make predictable substitutions that satisfy automated checks without deterring attackers. Because generative artificial intelligence can crack compliant passwords substantially faster than older methods, understanding these patterns helps organisations redesign authentication systems to resist advanced automated attacks before user accounts are compromised.
The work provides an open-source Python framework that appears ready for applied testing by enterprise security teams and software developers. The tool enables automated compliance audits, entropy calculations, and real-time strength feedback within user registration workflows. It also supports organisations transitioning toward passwordless authentication standards such as FIDO2 and WebAuthn to eliminate password vulnerabilities entirely.
AI-generated from the published abstract. Always read the original work before citing.
The objective of this paper was to analyze and evaluate password strength and weaknesses in common user-generated passwords and their susceptibility to PassGAN AI-based cracking using 14 million user-generated passwords from the RockYou2021 dataset using Python‘s data analysis stack (Pandas, Scikit-learn, Matplotlib, Seaborn) assess compliance with the NIST SP 800-63B guidelines. The results showed that 81.7% of the passwords failed to meet the 12-character minimum (median length: 9 characters), 29.4% contained predictable keyboard walks (e.g., qwerty‖), and 44% used trivial substitutions (e.g., @ for a) that bypassed complexity rules without improving security. Even NIST-compliant passwords were cracked 24.2% faster by PassGAN than by traditional brute-force methods, underscoring the heightened threat of AI-driven attacks. To address these vulnerabilities, we recommend replacing complexity requirements with length-focused policies supported by breach-based blocklists, incorporating real-time password strength feedback during creation, and accelerating the adoption of FIDO2/WebAuthn standards. Our open-source Python framework, featuring automated entropy calculations and policy compliance checks, equips organizations with actionable tools to bridge the gap between policy expectations and user behavior, ultimately enhancing resilience against both human predictability and AI-powered cracking techniques.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.4314/jasem.v29i11.8
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
