We have filtered the 100 million space down to 2,300,000 entries using three proprietary heuristics:
Instead of storing a 4.5GB file, use a mask attack with an exclusive rule set.
hashcat -a 3 -m 0 hash.txt ?d?d?d?d?d?d?d?d
This dynamically generates 8 digits without storing the wordlist.
Example – Cracking an 8-digit numeric hash with Hashcat: 8 digit password wordlist exclusive
hashcat -m 1400 -a 0 hash.txt 8digit_exclusive.txt -O -w 3
(Mode 1400 = SHA2-256; adjust for your target hash type)
For brute-force complement: Use the exclusive list first, then switch to incremental (?d?d?d?d?d?d?d?d) for leftovers.
Pro tip: Combine this list with rule-based attacks (e.g., -r best64.rule) to generate variations like 12345678 → 123456789 (no, wait, that’s 9 digits—exactly why you need precision). We have filtered the 100 million space down
An 8-digit numeric password ranges from 00000000 to 99999999. That's 100 million unique combinations.
In the landscape of cybersecurity, the "8-digit password" represents a critical threshold. For years, security standards (like NIST guidelines) and corporate policies have mandated a minimum of 8 characters. Consequently, attackers and auditors have built massive, "exclusive" databases specifically targeting this length.
An "exclusive" wordlist implies a curated or generated dataset tailored for specific targets, rather than a generic dictionary. This article explores the construction of these lists and how to defend against them. This dynamically generates 8 digits without storing the
Security researchers categorize passwords using "masks." An 8-character exclusive list often focuses on masks with high probability:
To illustrate the power of an exclusive wordlist, here are the current leaders (compiled from recent anonymized telemetry):
If your password is on this list, change it immediately.
If you are a penetration tester, using the full 100 million permutation list is inefficient. If you test at 100,000 passwords per second (common for NTLM hashes on a single GPU), the full list takes 16 minutes.
But if you use an exclusive wordlist—limited to the top 1 million most probable human-generated 8-digit passwords—you complete the test in 10 seconds. And with that 10 seconds, you will likely crack 30% of numeric passwords.