Dictionary attack — Comprehensive operation

Project reference document Time2Crack

Recipients: developers, security researchers, advanced users

Contents

1. Overview

Dictionary attack is the oldest password cracking method, the simplest conceptually, and statistically most effective on the majority of real human passwords. Its principle is to test, in descending order of probability, a pre-compiled list of candidates — the "dictionary" — rather than exhaustively enumerate all possible combinations as the raw force does.

In Time2Crack, the dictionary attack models two distinct but complementary mechanisms:

These two detections are independent and complementary: HiBP covers the exact compromise credentials, the wordlist covers the common words not yet leaked.

2. Historical and academic background

2.1 Origins

The dictionary attack precedes the modern era of computer security. The first Unix systems stored passwords in plain language in /etc/passwd, making any dictionary attack trivial as soon as the file was accessible.

2.2 Founding leaks

Some leaks have transformed the landscape of the attack by dictionary by revealing the actual distribution of human passwords:

• Password #1 ("123456") represented 290,731 accounts (2%)

2.3 Reference Benchmarks for Dictionary Attack

A wordlist of 200,000 entries tested at the speed of a RTX 4090:

The dictionary attack is therefore almost instantaneous for MD5, SHA-1 and NTLM — and remains very fast even for bcrypt on small lists.

3. Conceptual foundations: why dictionaries work

3.1 The Power Law of Human Passwords

All empirical studies converge towards the same observation: the distribution of human passwords is not uniform — it follows a law of power (Zipf). Some passwords concentrate an disproportionate fraction of choices.

Direct consequence: 10 most common passwords An attacker who tests only 10 candidates already has a chance in 20 to succeed — statistically, it's huge for the amount of noise generated.

3.2 Cognitive Bias in Password Creation

Humans do not choose at random. They systematically apply heuristics that make their passwords predictable:

3.3 The concept of "password already in the lists"

A password may be in an attack list for two different reasons:

These two cases correspond to attacks of a different nature, with different speeds — and this is precisely what Time2Crack models.

4. Architecture of a modern dictionary attack

4.1 General pipeline

A modern dictionary attack takes place in several phases:

Phase 1 : Constitution de la wordlist
    ├── Mots de passe fuités (HIBP, RockYou, Collections)
    ├── Wordlists linguistiques (dictionnaires, prénoms, lieux)
    ├── Wordlists thématiques (sport, pop culture, tech, religion)
    └── Wordlists contextuelles (domaine de l'entreprise cible, noms d'employés)
Phase 2: Wordlist Preprocessing
- Sort by frequency (most likely first)
- - Deduplication (not twice the same candidate)
- - Length filtration (target length + ±2)
- - Standardization (lowercase, Unicode NFC)
Phase 3: Calculation of Candidate Hashs
For each candidate w in the wordlist:
│ hashcandidate = hashalgo(w)
Promotional │ if hashcandidate== hashTarget : FINDED
- - Speed: 168 GH/s for MD5 on RTX 4090
Phase 4: Analysis of results
Report of cracked passwords, coverage statistics

4.2 Hardware optimizations

Modern dictionary attacks are massively paralleled on GPU:

For a wordlist of 14 billion entries (HIBP size) on 12× RTX 4090:

This difference of ~9 orders of magnitude between MD5 and bcrypt explains why the choice of the hash algorithm is critical.

4.3 Test order of candidates

The wordlist is not tested in alphabetical order — it is sorted by decreasing probability :

This sort ensures that if the password is "low", it will be found in the first milliseconds — whatever the hash speed.

5. The corpus of real passwords

5.1 Have I Been Pwned (HIBP)

HiBP is the global reference because:

An attacker with the complete HIBP dump can first test the ~14 billion candidates in descending order of frequency. For non-salted algorithms (MD5, SHA-1), this list covers in the order of 50-70% of all real online passwords.

5.2 RockYou (2009) — Founding corpus

5.3 Collections of specialized wordlists

These corpuses are publicly downloadable — their existence is an established fact of offensive security.

6. K-Anonymity Verification HIBP: A Real-Time Attack

6.1 Protocol k- anonymity

Time2Crack incorporates a real-time HIBP check that reproduces exactly what an attacker would do with the HIBP database — but never transmit the password in plain language or its full hash.

The k-anonymity protocol works as follows:

1. Calculer SHA-1(password)      → par exemple "CBFDAC6008F9CAB4083784CBD1874F76618D2A97"
Send only the first 5 characters to the HIBP API: "CBFDA"
The API returns ALL SHA-1 suffixes starting with "CBFDA" (approximately 400-600 hashes)
Search locally if the rest of the hash ("C6008F9CAB4083784CBD1874F76618D2A97") is in the list
If found: password has been compromised (HIBP also returns the number of leaks)

6.2 Implementation in Time2Crack (app.js)

The HIBP check is asynchronous and non-blocking. The password is immediately analyzed by local methods, and the HIBP check completes the result:

// Pseudo-code simplifié
async function checkHIBP(password) {
  const sha1 = await sha1Hash(password);
  const prefix = sha1.substring(0, 5);   // 5 premiers chars
  const suffix = sha1.substring(5);       // reste du hash
const response = await fetch(
    https://api.pwnedpasswords.com/range/${prefix}
  );
const lines = await response.text();
for (const line of lines.split('\n')) {
const [hashSuffix, count] = line.split(':');
if (hashSuffix.toLowerCase() = suffix.toLowerCase()) {
return parseInt(count); // number of leaks
}
}
return 0; // not found
}

6.3 Interpretation of Count HIBP

The count returned by HiBP indicates the number of times this exact password appeared in indexed leaks:

Even a count of 1 (the password appeared only once in a leak) indicates a vulnerability: if an attacker targets this account specifically and has the list of credentials of the leak in question, he will find it.

7. Time2Crack Language Wordlists

7.1 Why language wordlists in addition to HIBP

HiBP covers the exact compromise credentials — but not the common words never run away yet. A francophone user who chooses "ephemeral" as a password may not be in HiBP (the word is unlikely in anglophone credentials), but it is in the French wordlist of any attacker targeting a francophone system.

Time2Crack's language wordlists cover this gap:

7.2 Lazy loading

Wordlists are not included in the code — they are loaded on request when changing language, to meet the network budget:

// app.js - loadDictionary()
async function loadDictionary(lang) {
  if (DICTlang & DICTWORDS) return;  // Déjà chargé
  if (DICTLOADING) {
DICTPENDINGLANG = lang; // Waiting file
return;
}
DICTLOADING = true;
const res = await fetch(data/wordlists/${lang}.txt);
const text = await res.text();
// Convert to Set<string> for O(1) lookup
DICTWORDS = new Set(
text.split("\n")
.map(w => w.normalize("NFC").trim().toLowerCase())
.filter(w => w.length >= 4)
);
DICTLANG = Lang;
DICTLOADING = false;
}

Loading queue

The DICTPENDINGLANG avoids race conditions during rapid language changes:

Scénario : l'utilisateur switche rapidement EN → FR → DE
├── EN demandé : DICTLOADING = false → start of the fetch EN
FR requested during fetch EN : DICTLOADING = true → DICTPENDINGLANG = "fr"
├── DE demandé pendant fetch EN : DICTLOADING = true → DICTPENDINGLANG = "de" (crash "fr")
- Fetch Ends: DICTLANG = "en", puis lance loadDictionary("de")
└── Résultat : seule la dernière langue demandée est chargée

This behaviour is intentional: the most recently requested language is loaded, not all intermediate languages.

8. Dictionary Detection in Time2Crack: isDictWord()

8.1. Detection operation

The function isDictWord(pw) determines whether a password is or is derived from a current dictionary word:

// app.js - ligne 2181
function isDictWord(pw) {
  if (!DICT(WORDS) return false;
// Standardization: NFC + Lowercase
const l = pw.normalize("NFC").toLowerCase();
// Direct verification
if (DICT)WORDS.has(l) || DICTWORDS.has(deLeet(pw)) return true;
// Morphological variations
const deleetWord = deLeet(pw);
const variations = getMorphVariations(deleetWord);
for (const variation of variations) {
if (DICT)WORDS.has(variation)) return true;
  }
return false;
}

8.2 Unicode Standardization (NFC)

Standardization normalize("NFC") ensures that accented characters are treated consistently:

This standardization is applied both when creating the dictionary and when checking — ensuring correct correspondence for accent languages (FR, ES, DE, PT, etc.).

8.3 Impact on vulnerability detected

When isDictWord() Go back trueseveral attacks become applicable:

9. De-leetification: how the attacker decodes substitutions

9.1 Leetspeak and its limitations as protection

The leetspeak (or "1337 speech") is a practice of replacing letters with visually similar numbers or symbols: a→@, e→3, i→1 or !, o→0, s→$. Users use it to "strengthen" common words.

The reality: these substitutions are the first rules applied in any dictionary attack with rules of mutation. They do not constitute a real defense against a competent attacker.

9.2 Implementation of deLeet() in Time2Crack

// app.js - ligne 3622
const LEETBASE = {
a: ["@", "4"],
e: ["3"],
o: ["0"],
s: ["$", "5"],
t: ["+", "7"],
h: ["#"],
g: ["9"],
};
function ofLeetWith(pw, oneMap) {
let r = pw.normalize("NFC").toLowerCase();
for (const [ch, reps] of Object.entries(LEET)BASE))
    for (const c of reps) r = r.split(c).join(ch);
  // Appliquer la résolution ambiguë (i ou l) en dernier
  for (const [ch, reps] of Object.entries(oneMap))
    for (const c of reps) r = r.split(c).join(ch);
  return r;
}
function ofLeet(pw) {
// Ambiguity: "1" may be "i" or "l"
const withI = deLeetWith(pw, { i: "1!", l: "" });
const withL = deLeetWith(pw, { l: "1", i: "!" });
// If the dictionary is loaded, prefer the variant that matches
if (DICT)WORDS) {
if (DICT)WORDS.has(withL)) return withL;
if (DICT)WORDS.has(withI) return withI;
}
// Otherwise: prefer the variant with the least remaining numbers
const digestsI = (withI.match(/\d/g)
const digestsL = (withL.match(/\d/g)
return digit L <= digit I ? withL: withI;
}

9.3 Ambiguity Management "1" → "i" or "l"

The substitution "1" is ambiguous: "1" can represent "i" (as in "1nfo" → "info") or "l" (as in "p1ayer" → "player"). Time2Crack resolves this ambiguity by:

9.4 Substitutions not covered (intentionally)

Time2Crack does not cover rare or ambiguous substitutions beyond LEETBASE patterns. It is a design choice: covering too many cases would increase the false positives (detecting a password as a "current word" while it is not). The included patterns cover >95% of the actual leetifications observed in the corpus.

10. Calculation of cracking time: addDictionaryAttacks()

Calculation logic

// app.js - ligne 3848
function addDictionaryAttacks(rows, common, weak, dictWord) {
  for (const a of ALGOS) {
    let sec;
    if (weak)     sec = 100 / a.rate;     // Top ~100 entrées
    else if (common) sec = 10000 / a.rate; // HIBP priority list ~10k
    else if (dictWord) sec = 200000 / a.rate; // Scan wordlist complète ~200k mots
    else sec = null;                        // Non applicable
const note = weak ? t("nWeakPassword")
: common ? t("nInLeaks")
: dictWord ? t(nDictHit)
: t(nAbsentLeaks);
rows.push({ atk: t("aDict"), hash: a.name, spleen: a.rate, sec, note, cat: "dict" });
}
}

10.2 Three levels of vulnerability

10.3 Why these numbers (100, 10,000, 200,000)?

These values are calibrated to actual data:

10.4 Complete numerical example

For the "sun" password (current French word, detected as dictWord) :

Even for Argon2id, 250 seconds is less than 5 minutes — for a simple word from the French dictionary.

11. High fidelity calibration: applyHighFidelityCalibration()

11.1 Why additional calibration?

The gross calculation addDictionaryAttacks() gives an estimate of the "worst case" — as if the attacker was testing the entire wordlist uniformly. ordered by probability : the most common passwords arrive first.

High fidelity calibration applies a corrective multiplier based on empirical observations:

// app.js - ligne 4442
case "dict":
  // Ur et al. 2012 : mots communs trouvés dans les 100-10k premiers essais
  // Weir 2009 : mots dict trouvés dans les 200k premiers essais (scan ordonné)
  m = context.common ? 0.15: context.dictWord ? 0.5: 1.0;
Break;

11.2 Academic Sources of Calibration

12. Likelihood of applicability and confidence score

12.1 Scoring system

Time2Crack does not just calculate a time — it also evaluates the probability that the dictionary attack is actually the fastest attack, via a multi-factor scoring system:

// Score d'applicabilité (0-1)
case "dict":
  return context.common ? 0.99 : context.dictWord ? 0.85 : 0;

12.2 Evidence score

In parallel with the applicability score, a "evidence" score records the observed signals:

case "dict":
  return Number(!!context.common) + Number(!!context.dictWord);
  // 0 : aucun signal
  // 1 : un signal (common OU dictWord)
  // 2 : deux signaux (common ET dictWord)

An evidence score of 2 (word in both HIBP and the linguistic dictionary) boosts the final confidence of 0.08 (2 × 0.04).

12.3 Final Confidence Score

const base = confidenceBase["dict"] || 0.6;  // confiance de base
const evidenceBoost = Math.min(0.12, row.evidenceScore  0.04);
const speculativePenalty = speculativeCats.has("dict") ? 0.08 : 0;  // dict n'est pas spéculatif
row.confidence = Math.max(0, Math.min(1,
Math.max(applicability, base) + evidenceBoost - specificPenalty
));

For a password common with dictWord also detected:

Maximum confidence: The dictionary attack is the primary attack unambiguously.

13. Bloom filter RockYou: local detection of widespread passwords

13.1 Background

In addition to the HIBP verification (which requires a network call), Time2Crack incorporates a bloom filter A bloom filter is a probabilistic data structure that allows you to test belonging to a set with a probability of false positives (~1%), without storing the elements themselves.

13.2 Benefits of the bloom filter

13.3 Operation of double hashing

// app.js - ligne 1962
function bloomHas(filter, word) {
  if (!filter) return false;
  const { bitArray, m, k } = filter;
  const w = word.toLowerCase();
// Double-hashing: h1 and h2 are two independent hash functions
const h1 = fnv1a32(w, 2166136261); // FNV1a with standard seed
const h2 = fnv1a32(w, 0x811c9dc5); // FNV1a with alternative seed
for (let i = 0; i < k; i++) {
const pos = (h1 + (i  (h2) >>> (0)) % m; // k positions in the bit array
const byteIdx = Math.floor(pos / 8);
const bitIdx = pos % 8;
// If a bit is 0: the word is DEFINITLY absent
if ((bitArray[byteIdx] & (1 << bitIdx)) = 0) return false;
}
// All bits are at 1 : the word is PROBABLY present (with 1% of FP)
return true;
}

The FNV1a double-hashing ensures a uniform distribution of positions in the bit array, minimizing collisions and keeping the false positives rate close to 1%.

13.4 Loading and binary format

The bloom filter is stored in data/rockyou.bloom — a binary file with:

The load is triggered manually by the user (button in the UI), not automatically at the page loading — to preserve the initial performance.

14. Comparison with derived attacks

The "pure" dictionary attack is the first of a family of attacks that all share a common root: a lexical wordlist. Time2Crack implements 7 offline cracking models (gross force, dictionary, hybrid, mask, PCFG, Markov, combinator), each attacking the password from a different angle.

14.1 Dictionary vs Hybrid

The hybrid attack begins where the pure dictionary stops: it takes every word from the wordlist and applies systematic mutation rules (hashcat "best64.rule" in mind).

14.2 Dictionary vs PCFG

A password like "Password123" can go unnoticed in a dictionary (the exact word "Password123" may not be listed) but will be cracked very quickly by PCFG which recognizes the structure [Majuscule][minuscules][digits].

14.3 Dictionary vs Markov

Markov covers cases where the password looks like a human word without being in any list.

14.4 Dictionary vs Credential Stuffing

Credential stuffing does not attack a hash — it directly tries login/password pairs on remote services. It is conceptually different from cracking, but shares the same data source (HIBP/fail).

15. Limitations of attack dictionary

15.1 Intrinsic limits

15.2 What Time2Crack's Calculation Does Not Model

16. Effective defences

16.1 What protects against dictionary attack

The difference of 10+ orders of magnitude between MD5 and Argon2id makes the dictionary password "sun" immune in practice if protected by Argon2id — even if the attacker knows it is a French word.

16.2 What does not protect

16.3 Practical recommendations

17. References

Primary sources (academic studies)