Can pydictor work with lists I already have?

Yes. Modes via -tool such as comparer, combiner, and uniqifer merge, compare, and deduplicate existing wordlists. -extend also permutes a seed list.

Why build a custom list instead of a big generic one?

A list tuned to the target tries likely passwords earlier, so a brute force spends fewer attempts on unlikely candidates.

What do the plugins do?

-plug selects generators such as birthday, pid6, pid8, and ftp that turn identity facts into candidate passwords instead of a raw character-set expansion.

Can pydictor output hashes instead of plaintext?

Yes. --encode can emit md5, sha1, sha256, base64, and other encodings of each entry when you need a hashed dictionary.

Updated Jul 15, 2026

Passwords

Generate target-specific brute-force wordlists

Rule-driven wordlist builder for brute-force pipelines.

Build a target-specific password list Generate lists from identity data Merge, dedupe, and filter existing lists

overview

What pydictor does

pydictor is the wordlist stage before a cracker. Set -base and --len, optionally --head, --tail, and --leet, to emit a dictionary tuned to the target instead of a generic dump.

Modes via -tool such as combiner, uniqifer, and comparer clean lists you already hold. -extend permutes a seed file; --encode can emit md5, sha256, or base64 of each entry.

Trickest runs pydictor as a managed Passwords node that writes a folder of results. Feed the list to hydra or another brute-forcer. Prefer cewl when the list should come from site content instead of rules.

source github.com/LandGrey/pydictor

use cases

Where pydictor fits

Build a target-specific password list

Combine a base character set, a length range, and prefixes or suffixes drawn from the target so the brute force tries likely passwords first.

Generate lists from identity data

Use the birthday or ID-card plugins to turn known facts about a target into candidate passwords for a focused attack.

Merge, dedupe, and filter existing lists

Run combiner and uniqifer modes with regex or character-type filters to clean and consolidate wordlists you already hold.

Encode wordlists for hash-oriented attacks

Apply --encode to emit md5, sha256, base64, or other encodings of each entry when the attack surface expects hashed or encoded values.

reference

pydictor inputs and flags

34 inputs

Name	Type	Flag	Description
mode	STRING	-tool	Mode: handler, shredder, hybrider, comparer, combiner, uniqbiner, counter, or uniqifer.
base-type	STRING	-base	Base character set (d, L, c, dL, dc, Lc, dLc).
length	STRING	--len	Minimum and maximum password length.
add-prefix	STRING	--head	Prefix added to every generated item.
add-suffix	STRING	--tail	Suffix added to every generated item.
enable-leet	STRING	--leet	Apply 1337 substitutions by code (0, 1, 2, 11-19, 21-29).
encode-type	STRING	--encode	Encode each entry (md5, sha256, b64, des, and more).
wordlist-to-permutate	FILE	-extend	Extend an existing wordlist based on rules.

Showing key inputs. pydictor exposes 34 inputs in total.

Full flag reference (34 inputs)

Name	Type	Flag	Description
mode	STRING	-tool	Specify mode. [handler,shredder,hybrider,comparer,combiner,uniqbiner,counter,uniqifer]
plug	STRING	-plug	Specify plugin. (pid4,scratch,birthday,pid8,ftp,pid6) [e.g pid6(id card last6 char wordlist)]
chunk	STRING	-chunk	Specify chunk. [chunk1] [chunk2] ...
d-m-y	STRING	--dmy	Use ddMMyyyy format date, default date format: yyyyMMdd
length	STRING	--len	Specify length of password. [e.g (minlen) (maxlen)]
base-type	STRING	-base	Base type. Choose from [d, L, c, dL, dc, Lc, dLc]. (d=digital [0 - 9], L=lowercase letters [a - z], c=capital letters [A - Z], dL=mix d and L [0-9 a-z], dc=Mix d and c [0-9 A-Z], Lc= Mix L and c [a-z A-Z], dLc= Mix d, L and dL [0-9 a-z A-Z])
set-level	STRING	--level	Set the word list rule level.
add-prefix	STRING	--head	Add items prefix.
add-suffix	STRING	--tail	Add items suffix.
custom-char	STRING	-char	Custom char
enable-leet	STRING	--leet	Enable 1337 mode [code] (0, 1, 2, 11-19, 21-29)
encode-type	STRING	--encode	Please specify encodee type. [test,b16,sha512,des,md516,rsa,b64,b32,none,execjs,url,hmac,sha1,sha256,md5]
pattern-file	FILE	--pattern	Please specify pattern file
filter-by-occur	STRING	--occur	Please specify occur filter. [letter] [digital] [special]
filter-by-regex	STRING	--regex	Please specify regex filter.
filter-by-types	STRING	--types	Please specify filter types. [letter] [digital] [special]
filter-by-repeat	STRING	--repeat	Filter by consecutive repeat times of letter, digital, special chars
counter-mode-file	FILE	·	Specify the counter mode file.
counter-mode-mode	STRING	·	Specify the counter mode. ['v','s','vs']
handler-mode-file	FILE	·	Specify the handler mode file.
shredder-mode-dir	FOLDER	·	Specify the shredder mode dir.
configuration-file	FILE	--conf	Specify configuration file.
pattern-expression	STRING	--pattern	Please specify file with pattern expression.
shredder-mode-file	FILE	·	Specify the shredder mode file.
uniqbiner-mode-dir	FOLDER	·	Specify the uniqbiner mode dir.
uniqifer-mode-file	FILE	·	Specify the uniquer mode file.
counter-mode-number	STRING	·	Specify counter mode number. [view_num]
hybrider-mode-file1	FILE	·	Specify the hybrider mode first file.
hybrider-mode-file2	FILE	·	Specify the hybrider mode second.
combiner-mode-folder	FOLDER	·	Specify directory for combiner mode.
wordlist-to-permutate	FILE	-extend	Extend wordlist based on rules. [e.g names.txt]
configuration-expression	STRING	--conf	Specify configuration expression.
comparer-mode-minuend-file	FILE	·	Specify the minuend file for comparer mode.
word-to-create-password-of	STRING	-extend	Extend wordlist based on rules. [e.g bob]

example

Run pydictor

pydictor · command

# generate a short lowercase+digit list with a company prefix and leet variantspydictor -base dL --len 4 6 --head acme --leet 1

sample output

[+] start generating wordlist...[+] base=dL len=4-6 head=acme leet=1acme1234acme123aacme12abacmea1b2acme2024acme@123[+] 18432 lines written to results/wordlist.txt

guidance

Choosing pydictor

Use pydictor to build a custom wordlist before a brute-force run, especially when a target-specific list beats a generic dump. It produces lists; it does not attack. Feed output to hydra or a panel brute-forcer.

cewl

Scrapes a website to build a wordlist from page content. pydictor generates from rules and plugins instead.

clean-wordlist

Cleans and dedupes an existing list. pydictor can also do this via comparer and uniqifer modes.

hydra

Brute-force engine that consumes a pydictor list against a login.

faq

pydictor questions

Set -base dL for digits plus lowercase letters, then bound size with --len, for example pydictor -base dL --len 4 6 --head app.

Run pydictor yourself

Rules and a base set feed pydictor, which generates a custom wordlist for hydra to brute-force a login before any valid credential lands as output.

Open pydictor in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.