A Deep Learning Approach to Assess Password Strength

In one of my research projects, I worked on a deep learning-based system that checks how weak or strong a password really is. In simple words, the goal was to build a model that can look at a password and understand whether it follows a predictable pattern that attackers can guess easily. The main idea was not to replace existing password checkers, but to make them smarter. Most password meters today only count characters. Our approach tries to understand the password itself.

Why I Chose This Topic

Almost everyone today has many online accounts. Email, banking, social media, university portals, office systems. In most cases, the only thing protecting those accounts is a password. But people usually choose passwords that are easy to remember, and easy to remember often means easy to guess.

When a website tells you your password is “Strong”, you feel safe. But that feeling can be false. A password like Password@2024 has uppercase letters, lowercase letters, a number, and a special character. Most strength meters will happily call it strong. In reality, it is one of the first things an attacker would try.

That gap between looks strong and actually strong is what I wanted to work on.

The Main Problem

Traditional password strength meters are rule-based. They mostly check a few things like is the password long enough or does it have uppercase and lowercase letters? Does it have numbers? Does it have special characters? These rules are useful, but they miss the most important thing: patterns.

Humans are predictable. We put 123 at the end. We replace a with @ and o with 0. We add a birth year. We use names of people we love. Attackers know all of this, and they use huge lists of leaked passwords to guess accordingly. So a password can pass every rule and still be cracked in seconds, simply because millions of people have thought of something similar before. Rules cannot catch that. Patterns can only be learned from real data.

Dataset Used (and How I Prepared It)

For this project, I used the well-known rockyou.txt dataset, taken from Kaggle and GitHub. This comes from a real password leak. The dataset contained over 10 million password entries.

But raw data is never ready to use. So I converted both datasets to UTF-8 encoding, removed all duplicate passwords and removed passwords containing non-ASCII or corrupted characters.

After cleaning, we were left with 1,920,298 unique passwords. This became our final dataset for training and evaluation. I want to be honest here: we deliberately kept the scope small and ASCII-only.

This was a proof-of-concept study, not a production system.

How Our System Works

Our proposed system has three main parts.

1. Tokenization and Padding

A deep learning model cannot read text directly. It only understands numbers. So the first step was to break each password into small pieces called tokens, and then convert those tokens into numbers.

We used an n-gram approach with n = {1, 2, 3}. That means for every password, we extracted:

• Unigrams — single characters, like p, a, s
• Bigrams — pairs of characters, like pa, as, ss
• Trigrams — triplets of characters, like pas, ass, ssw

Why not just single characters? Because password weakness usually lives in short combinations, not in single letters. The trigram 123 says far more about weakness than the digit 1 alone.

Since passwords have different lengths and the model needs inputs of the same size, we added padding. We picked a maximum length based on the longest password in the dataset, and filled the remaining positions of shorter passwords with a special PAD token.

2. Embeddings

After tokenization, each token had a number assigned to it. But a plain number does not carry meaning. The number for 123 and the number for abc tell the model nothing about how these tokens relate to each other.

So we used an embedding matrix. This is a learnable table where every token is represented as a vector of continuous values. During training, the model adjusts these vectors so that tokens appearing in similar contexts end up with similar representations.

In simple terms, embeddings give each piece of a password a meaning that the model can actually work with.

3. The Password Detector Model (GPT-2)

The tokenized and embedded passwords were then fed into a GPT-2 model.

GPT-2 is a language model. Its original job is simple: given some text, predict what comes next. We used exactly the same idea, but instead of words in a sentence, our sequence contained tokens of a password. The model learned to predict the next token given all the previous ones, and it was trained by minimizing negative log-likelihood loss.

Now comes the interesting part. Once the model was trained, we did not use it to generate passwords. We used it to measure surprise, using a metric called perplexity.

Perplexity tells us how confidently the model can predict a sequence:

• Low perplexity means the model easily predicted the password. It has seen this kind of pattern many times. → Weak password
• High perplexity means the model was surprised. The password does not follow a familiar pattern. → Stronger password

This is the core intuition of the whole paper. If a machine trained on millions of leaked passwords can guess your password without effort, an attacker can too.

What the Data Told Us

Before looking at model performance, we analysed the dataset itself. Some of the findings were quite revealing:

• Most common characters: a, e, 1, and 0 were the most frequent characters across all passwords.
• Most common 3-grams: 123 was the clear winner, followed by 200, ove, and lov. So yes, number sequences and the word “love” are everywhere.
• Password composition: 65.6% of characters were letters, 33.2% were digits, and only 1.2% were special characters.
• Password length: Most passwords were 8 to 10 characters long, with a sharp peak at 8. Very few passwords were longer than 15 characters.

We also built co-occurrence heatmaps for letters, numbers, and special characters, to see which pairs tend to appear together. These patterns are exactly what a rule-based meter is blind to.

The takeaway is simple: people write passwords the same way they write language. That is precisely why a language model is a reasonable tool for this problem.

Results

We evaluated the trained GPT-2 model on a test set of passwords using perplexity.

The results show that the model was very good at catching the obvious cases. Common and easily guessable passwords received very low perplexity, exactly as expected. For longer and more random passwords, perplexity increased significantly, which means the model found them genuinely unpredictable.

However, the overall performance was limited. When we plotted perplexity against password complexity, we saw that the model struggled more as complexity increased. Two reasons explain this:

1. Limited dataset. Nearly 2 million passwords sounds like a lot, but it still lacks the diversity and scale needed. Unusual and highly secure passwords simply do not appear often enough for the model to learn them.
2. Model constraints. We used a smaller version of GPT-2. It does not have the capacity to capture the full range of password structures. A larger transformer would very likely do better.

So I would describe the results this way: the approach clearly works in principle, and it clearly needs more scale to work in practice.

What I Learned

This research taught me that a good idea is not enough by itself. Data preparation took far more time than model building. Encoding problems, duplicate entries, corrupted characters, inconsistent lengths — all of these had to be solved before any learning could happen.

I also learned something more conceptual. A model built for language turned out to be useful for security, because human password habits are themselves a kind of language. Recognising that connection was the most satisfying part of the project.

And finally, I learned that low performance numbers are not failures. They tell you where the real bottleneck is.

Limitations

Our model worked, but it was not perfect.

• The dataset was limited to ASCII characters, so non-English and multilingual passwords were completely excluded.
• We used a small GPT-2 variant, which restricted how much complexity the model could capture.
• Perplexity is a useful signal, but it is not a finished product. Turning a perplexity value into a clear “weak / medium / strong” label for real users still needs calibration.
• The datasets came from old leaks. Password habits change over time, so a model trained on them may lag behind current trends.
• There is also an ethical side. A model that understands password patterns well enough to judge them also understands them well enough to guess them. The same capability can defend or attack, so this kind of work must be handled responsibly.

Future Work

There are several directions worth exploring:

• Train on larger and more diverse datasets, including passwords from multiple languages and cultures.
• Use a larger transformer model to capture deeper structural relationships between characters.
• Convert perplexity into a practical time-to-crack estimate that ordinary users can immediately understand.
• Build a user-friendly interface so that the feedback is not just accurate but also actionable, suggesting a stronger alternative instead of only rejecting the password.

Final Thoughts

This research focused on using a deep learning model to assess password strength, compromise likelihood, and time-to-crack estimation. The project combined dataset cleaning, n-gram tokenization, embeddings, and a GPT-2 model evaluated through perplexity.

The final result was a system that could reliably identify predictable passwords, along with a clear picture of what is needed to push it further. More than the numbers, what stays with me is the underlying lesson: password strength is not about how complicated a password looks. It is about how surprising it is. And surprise is something a machine can measure.