PentaPassBreaker: Intelligent Password Prediction via Neural Networks by Analyzing Password Update Patterns

Despite advancements in password policy enforcement and user awareness, individuals continue to follow predictable patterns when updating or creating new passwords across different sites-often making minor changes such as appending digits, capitalizing letters, or adding special characters. To model and exploit such behavioral regularities, we presentPentaPassBreaker, a novel sequence-to-sequence generative model for password prediction. As a foundation for learning real-world update patterns, we introduce a large-scale lexical similarity filtering of leaked credentials, extracting 307 million high-similarity password pairs through noise cleaning and similarity-based clustering. Our analysis reveals that users reuse an average of 3.2 closely related passwords per account, highlighting the prevalence of fine-grained reuse behavior. Experimental results show that PentaPassBreaker achieves an average top-5 accuracy of 22.1%, with simple transformation paths exceeding 35% in top-25 accuracy. Qualitative analysis further reveals that even incorrect guesses often resemble plausible user updates, demonstrating strong behavioral fidelity. Moreover, PPB consistently outperforms strong rule-based baselines such as John the Ripper (JTR), particularly on structural and multi-edit transformation paths under strict top-$k$budgets. These findings highlight the overlooked risks associated with incremental password reuse and emphasize the need for stronger user awareness and authentication safeguards.