Build a custom brute-force wordlist from rules

pydictor generates the wordlists that password attacks run against. Rather than reaching for a generic rockyou-style dump, you build a list tuned to the target: base character sets, a length range, prefixes and suffixes, leet substitutions, and date formats. The result is a smaller, sharper dictionary that finds weak credentials faster than a giant generic list.

It ships modes and plugins that go beyond raw generation. Plugins build lists from identity data like birthdays or ID-card patterns, and modes such as comparer, combiner, uniqifer, and counter let you merge, dedupe, and analyse lists you already have. Filters by regex, character type, or repeat count trim the output, and an encode step can emit hashes or encodings of every entry.

On Trickest it is a Passwords node that takes a mode, character and length options, rules, and filters, and writes a folder of results. Run it ahead of a brute-force stage to produce a target-specific dictionary instead of a one-size-fits-all list.