Dictionary Attack Probability Calculator

P(success) = P(password is in the corpus) × (guesses made ÷ (words × mangling rules)), capped at the in-corpus probability. A dictionary attack never searches the full keyspace — it searches a ranked candidate list built by applying mangling rules to every word. The chance of success is therefore the chance the target password is somewhere in that list, multiplied by the fraction of the list the attacker actually gets through. Because the list is ordered by real-world frequency, early guesses are worth far more than this uniform model suggests.

It explains why a policy-compliant password like Summer2024! dies in seconds: rule-mangled wordlists reach it after a few million guesses, while brute force would need 10^23.

This calculator takes 5 inputs: Wordlist size, Mangling rules per word, Guesses the attacker makes, Chance the password is in the corpus, Attack rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

This model assumes the attacker walks the candidate list in random order. Real cracking tools order candidates by observed frequency, so the first million guesses recover far more than one millionth of the list — commonly 20–30 % of a leaked hash set. Treat the output as a floor.

Block the corpus rather than trying to out-run it: screen new passwords against a breach list, require length instead of composition, and use a memory-hard hash so each candidate costs the attacker real time.