Password Mutation: Dictionary Attack Rules in Passcovery

You've probably heard this bad advice: "Replace letters with symbols, add some numbers, and you'll have a strong password." No, that doesn't work. Password recovery software applies these same transformations to millions of dictionary words automatically.

Think of it this way: Mutation works like a barista with a basic espresso shot: one base ingredient becomes dozens of drinks. Espresso + milk = latte. Espresso + foam = cappuccino. Espresso + cream + syrup = flavored specialty. The software does the same thing: it takes the word "password" and creates Password, password123, p@ssw0rd. One base–hundreds of variants to test.

What Is Password Mutation and How Does It Work?

The software takes a word, applies a transformation rule, and generates a candidate for testing. For example: the word password + rule .c99 (capitalize first letter + append "99") = Password99. This is called a rule-based attack–a dictionary attack with transformation rules.

The principle is simple: mutation expands your dictionary without increasing its size. Instead of storing 10 million pre-made passwords, the software keeps 10 thousand base words and a set of rules. Rules generate variants on the fly–this is candidate generation.

Here's how the process looks:

Each rule is a transformation instruction. Passcovery, Hashcat, and John the Ripper all use a macro language to define rules. The modifier .l converts letters to lowercase, .R reverses the word.

Why does this work? Mutation doesn't invent words–it mimics human behavior. And humans are predictable: according to NIST data, when required to create a "complex password," 82% of users come up with combinations like Password123!.

If you remember your password's structure–the base word, added numbers, letter substitutions–mutation will find it in minutes. For truly random combinations, mask attack or brute force works better.

What Are the Most Common Mutation Rules?

Four patterns cover 70-80% of real-world passwords: leet-speak, case toggling, number appending, and word combining. Software checks these first.

Mutation effectiveness in numbers

• Dictionary of 100 words → 100 passwords
• + case rules → 400 passwords
• + leet-speak → 2,000+ passwords
• + numbers (00-99) → 200,000+ passwords

Result: search space expansion of 2,000x or more, without increasing dictionary size.

Passcovery's rule syntax is similar to Hashcat and John the Ripper, but has some differences. For example, $w.c$x.l means: take a word from the first dictionary with a capital letter, add a word from the second in lowercase. The complete list is in the help documentation for each Passcovery program; Hashcat users will recognize familiar patterns.

When Is Mutation Effective–and When Isn't It?

Mutation works when you remember your password's structure. For random combinations like 7xKnmQ2, it's useless. Mask attack is better for those.

How to Create Mutation Rules for Your Situation

Open the Rules Editor in your Passcovery program, describe transformations using macros, and test on sample words. This takes some setup time, but well-crafted rules will save days of brute forcing.

The Rules Editor is a visual tool: enter test words, define rules, and see results instantly. Syntax errors are caught before you start the attack.

Basic syntax:

Ready-made rules for some typical scenarios:

• $w.c – word with first letter capitalized
• $w.u123 – word in uppercase + "123" at the end
• $w.sa@.se3.si1 – leet-speak substitutions

For complex scenarios involving multiple dictionary combinations, automated multi-file checking, and attack chains for forgotten passwords, use automation through attack scripts. The complete reference for modifiers and operators is in the macro language syntax documentation.

Where Password Mutation Is Used

Rule-based dictionary attack with mutation is available in all Passcovery products:

All programs share the same interface and identical mutation rule syntax.

FAQ: Common Questions About Mutation

Author: Denis Gladysh, Co-owner and Head of Passcovery. Passcovery is a provider of high-speed GPU-accelerated software solutions for recovering passwords for popular file formats. Denis is the author of the first versions of Accent OFFICE Password Recovery, created in 1999.