This repository is a curated 'awesome list' of password cracking tools, research, and resources — not a software application. The primary artifact is a single, comprehensive README.md that catalogs ~150 tools and resources across 15+ categories: hashcat automation/distributed cracking/rules, John the Ripper tooling, cloud-based cracking (AWS/Colab), wordlist generators and analyzers, hash conversion utilities, ML/AI password guessing models, academic papers (2009-2026), and notable researchers in the field. The list is alphabetically sorted, CC0-licensed, and maintained by a human curator who explicitly rejects AI-generated contributions. The repo's engineering value lies in its community governance infrastructure. A GitHub Actions workflow (pr-quality.yaml) uses peakoss/anti-slop to automatically detect and close AI-generated or spam PRs, enforcing account age, profile completeness, PR size limits, and maintainer-can-modify permissions. A second workflow runs awesome-lint to enforce list formatting standards. The PR template requires AI self-disclosure via a magic string. This governance stack is a genuinely reusable pattern for any community-curated repository facing AI slop. The content is current (papers through 2026) and the repo is actively maintained with zero open issues. While it contains no application code, it serves as a high-value reference index for security researchers, penetration testers, and anyone working on password recovery or authentication security. The hybrid nature: it's a curated data resource (the list itself) wrapped in application-grade CI/CD governance.
AlterX is a Go CLI tool and library for generating subdomain wordlists using a DSL (Domain-Specific Language) for patterns and an optional pattern mining mode. It ingests a list of known subdomains, extracts variables (sub, suffix, root, etc.), and applies user-defined or automatically discovered patterns to produce permutations. The architecture is modular: a Mutator engine orchestrates either default pattern-based generation (using ClusterBomb cartesian product) or pattern mining (via edit-distance clustering, n-gram analysis, and DFA-based regex generation). Key entry points are the CLI (`cmd/alterx/main.go`) and the library API (`mutator.go`). External dependencies include `fasttemplate` for variable replacement, `publicsuffix` for domain parsing, and `projectdiscovery/utils` for deduplication and other utilities. The pattern mining subsystem (ported from Regulator) uses a three-phase clustering algorithm and Brzozowski's DFA minimization to generate subdomains from observed patterns. The tool supports three modes: default (user patterns), discover (mined patterns only), and both (combined).
Mentalist is a desktop GUI application for generating custom wordlists targeting password security auditing. Built with Python Tkinter, it allows users to construct chains of operations (base words, case changes, substitutions, appending/prepending) to produce wordlists or rule sets compatible with Hashcat and John the Ripper. The application follows an MVC architecture: the model handles chain/node/attribute logic, the view manages Tkinter UI components, and the controller mediates between them. Key features include real-time word count estimation, saving/loading chain configurations, and background threading for responsive UI during intensive operations. The tool is designed for authorized penetration testing and includes bundled word lists and reference data.