PII2PW: Personal Information to Password Wordlists

Abstract.We evaluate PII2PW, a rule-based targeted password guessing tool for Chinese users, against CUPP (the de-facto standard) and published results from six academic papers spanning CCS 2016 to S&P 2025. Using five standard profiles and a 200-record synthetic PII–password paired dataset modelled after real Chinese password patterns (Li, Wang & Sun, INFOCOM 2016), we measure generation performance, PII embedding rate, dataset hit rate, and Success Rate @ N. PII2PW reaches 97.5% coverage and SR@100 = 46.5% on this set, generating 6× faster than CUPP with zero training data, GPU, or external dependencies. Because the paired set is synthetic and shares its assumptions with the rule engine, these absolute values are optimistic and are not comparable with the academic baselines below — see the fair-comparison caveat in §6.

1.Key Results

2.Generation Performance

We measure password generation throughput across five standard benchmark profiles — three Chinese (zh_full, zh_minimal, zh_medium) and two English (en_full, en_minimal). All measurements are wall-clock on a single CPU thread.

3.PII Embedding Rate

Fraction of generated candidates that contain a fragment of the target’s personal information. Higher rates indicate more targeted generation. The Personal-PCFG study (Li, Wang & Sun, INFOCOM 2016) observed that 60.1% of the leaked 12306 passwords contain at least one type of PII.

4.Academic Comparison: Success Rate @ N

The primary metric in the targeted password guessing literature. Given a PII–password paired dataset, what fraction of target passwords appears within the first N guesses? PII2PW, CUPP and bopscrk are evaluated on 200 synthetic records modelled after real Chinese password patterns (SR@N shown where a candidate ordering was captured); the remaining baselines are reported numbers from their respective papers on real leaked corpora — see fair-comparison caveat in §6.

5.Guess-Number and Distribution Statistics

For passwords that were ultimately found, at what rank in the generated list did they appear? Lower ranks indicate better priority ordering.

The two tools also produce nearly disjoint candidate sets, suggesting they could be productively combined. Length distributions differ markedly: CUPP concentrates 82% of its output in the 9–12 character range, while PII2PW spreads across 1–24 characters in line with observed Chinese password length distributions.

6.Discussion

Strengths.

PII2PW reaches SR@100 = 46.5% and SR@10⁴ = 97.5% on our set, up from 1.0% and 84.0% before the generation order was reworked. The gain at small N came entirely from ranking: the previous static priority list emitted roughly 2,000 single-component variants before it reached name+birthdate, the most common Chinese password shape, so correct guesses landed near rank 2,800. Its 51.0% PII embedding rate on zh_full — versus CUPP’s 33.2% — confirms more targeted candidate generation. PII2PW is roughly 6× faster than CUPP with zero training data, zero GPU, and no dependency beyond a pip install.

Limitations.

The median hit-rank is 318: PII2PW still places most correct passwords in the hundreds, not the first dozen, and SR@10 = 11.0% is where a rule engine shows its ceiling. Its ordering is a hand-authored stage list, not a learned likelihood — it cannot rank two candidates within a stage, which is precisely what a trained model does. Replacing the static priority with a learned scorer over the same candidate set is the natural next step, and needs far less data than training a generator: only (profile, candidates, which one was correct). Separately, the built-in common-passwords dataset is no longer an independent test set — PII2PW now ships a generic weak-password fallback that overlaps it by construction, which is why its hit rate there jumped from 8.2% to 71.3%. Judge hit rate on rockyou instead.

Fair-comparison caveat.

The academic baselines (TarGuess, PassLLM, etc.) were evaluated on real leaked PII–password datasets — typically 12306, Dodonew — with 10⁵-plus records. Our evaluation uses 200 synthetic records modelled after published Chinese password patterns. The comparison is therefore directionally informative but not strictly equivalent.

Positioning.

PII2PW occupies a distinct niche: to our knowledge it is the only actively maintained, rule-based, Chinese-localised password profiling tool that requires neither training data nor GPU. That makes it a pragmatic option for penetration testers who cannot deploy machine-learning infrastructure — but its numbers here and the published baselines are measured on different corpora and should not be read as a ranking.

7.References