{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T18:15:50Z","timestamp":1778782550663,"version":"3.51.4"},"reference-count":59,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2022YFB3102902"],"award-info":[{"award-number":["2022YFB3102902"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Expert Systems with Applications"],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1016\/j.eswa.2026.131318","type":"journal-article","created":{"date-parts":[[2026,2,2]],"date-time":"2026-02-02T15:51:47Z","timestamp":1770047507000},"page":"131318","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["PGMaP: Password generation based on mask prediction"],"prefix":"10.1016","volume":"311","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-8762-8279","authenticated-orcid":false,"given":"Chenyang","family":"Wang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4533-2706","authenticated-orcid":false,"given":"Fan","family":"Shi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3308-9123","authenticated-orcid":false,"given":"Shasha","family":"Guo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6654-7610","authenticated-orcid":false,"given":"Min","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2923-7963","authenticated-orcid":false,"given":"Yi","family":"Shen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7405-7710","authenticated-orcid":false,"given":"Chengxi","family":"Xu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8102-5239","authenticated-orcid":false,"given":"Pengfei","family":"Xue","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"key":"10.1016\/j.eswa.2026.131318_bib0001","series-title":"2012\u202fIEEE Symposium on security and privacy","first-page":"538","article-title":"The science of guessing: Analyzing an anonymized corpus of 70 million passwords","author":"Bonneau","year":"2012"},{"key":"10.1016\/j.eswa.2026.131318_bib0002","series-title":"2012\u202fIEEE Symposium on security and privacy","first-page":"553","article-title":"The quest to replace passwords: A framework for comparative evaluation of web authentication schemes","author":"Bonneau","year":"2012"},{"issue":"7","key":"10.1016\/j.eswa.2026.131318_bib0003","doi-asserted-by":"crossref","first-page":"78","DOI":"10.1145\/2699390","article-title":"Passwords and the evolution of imperfect authentication","volume":"58","author":"Bonneau","year":"2015","journal-title":"Communications of the ACM"},{"key":"10.1016\/j.eswa.2026.131318_bib0004","series-title":"Icassp 2021-2021 IEEE international conference on acoustics, speech and signal processing (ICASSP)","first-page":"2690","article-title":"Improved probabilistic context-free grammars for passwords using word extraction","author":"Cheng","year":"2021"},{"issue":"2","key":"10.1016\/j.eswa.2026.131318_bib0005","first-page":"821","article-title":"Password cracking based on learned patterns from disclosed passwords","volume":"9","author":"Chou","year":"2013","journal-title":"IJICIC"},{"issue":"1","key":"10.1016\/j.eswa.2026.131318_bib0006","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1109\/MSP.2017.2765202","article-title":"Generative adversarial networks: An overview","volume":"35","author":"Creswell","year":"2018","journal-title":"IEEE Signal Processing Magazine"},{"key":"10.1016\/j.eswa.2026.131318_bib0007","series-title":"Proceedings of the 22nd ACM SIGSAC conference on computer and communications security","first-page":"158","article-title":"Monte Carlo strength evaluation: Fast and reliable password checking","author":"Dell\u2019Amico","year":"2015"},{"key":"10.1016\/j.eswa.2026.131318_bib0008","unstructured":"Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2018). BERT: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv: 1810.04805."},{"key":"10.1016\/j.eswa.2026.131318_bib0009","series-title":"European symposium on research in computer security","first-page":"317","article-title":"The revenge of password crackers: Automated training of password cracking tools","author":"Di Campi","year":"2022"},{"key":"10.1016\/j.eswa.2026.131318_bib0010","series-title":"Engineering secure software and systems: 7th international symposium, ESSos 2015, Milan, Italy, march 4\u20136, 2015. proceedings 7","first-page":"119","article-title":"OMEN: Faster password guessing using an ordered markov enumerator","author":"D\u00fcrmuth","year":"2015"},{"issue":"3","key":"10.1016\/j.eswa.2026.131318_bib0011","first-page":"226","article-title":"OneRuleToFindThem: Efficient automated generation of password cracking rules","volume":"39","author":"Eckroth","year":"2023","journal-title":"Journal of Computing Sciences in Colleges"},{"key":"10.1016\/j.eswa.2026.131318_bib0012","series-title":"Password guessing based on semantic analysis and neural networks: 12th Chinese conference, CTCIS 2018, Wuhan, China, october 18, 2018, revised selected papers","author":"Fang","year":"2019"},{"key":"10.1016\/j.eswa.2026.131318_bib0013","series-title":"NDSS","first-page":"21","article-title":"Who are you? A statistical approach to measuring user authenticity","volume":"vol. 16","author":"Freeman","year":"2016"},{"key":"10.1016\/j.eswa.2026.131318_bib0014","series-title":"Journal of physics: Conference series","first-page":"012012","article-title":"PGGAN: Improve password cover rate using the controller","volume":"vol. 1856","author":"Guo","year":"2021"},{"issue":"10","key":"10.1016\/j.eswa.2026.131318_bib0015","doi-asserted-by":"crossref","first-page":"4607","DOI":"10.3390\/app11104607","article-title":"Dynamic Markov model: Password guessing using probability adjustment method","volume":"11","author":"Guo","year":"2021","journal-title":"Applied Sciences"},{"issue":"1","key":"10.1016\/j.eswa.2026.131318_bib0016","doi-asserted-by":"crossref","first-page":"28","DOI":"10.1109\/MSP.2011.150","article-title":"A research agenda acknowledging the persistence of passwords","volume":"10","author":"Herley","year":"2011","journal-title":"IEEE Security & Privacy"},{"key":"10.1016\/j.eswa.2026.131318_bib0017","series-title":"Applied cryptography and network security: 17th international conference, ACNS 2019, Bogota, Colombia, june 5\u20137, 2019, proceedings 17","first-page":"217","article-title":"PassGAN: A deep learning approach for password guessing","author":"Hitaj","year":"2019"},{"issue":"8","key":"10.1016\/j.eswa.2026.131318_bib0018","doi-asserted-by":"crossref","first-page":"1776","DOI":"10.1109\/TIFS.2015.2428671","article-title":"Next gen PCFG password cracking","volume":"10","author":"Houshmand","year":"2015","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.1016\/j.eswa.2026.131318_bib0019","series-title":"International conference on security and privacy in new computing environments","first-page":"159","article-title":"RLPassGAN: Password guessing model based on gan with policy gradient","author":"Huang","year":"2021"},{"issue":"2","key":"10.1016\/j.eswa.2026.131318_bib0020","doi-asserted-by":"crossref","first-page":"125","DOI":"10.1109\/TIFS.2006.873653","article-title":"Biometrics: A tool for information security","volume":"1","author":"Jain","year":"2006","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"10.1016\/j.eswa.2026.131318_bib0021","unstructured":"Jin, M., Ye, J., Shen, R., & Lu, H. (2024). Search-based ordered password generation of autoregressive neural networks. arXiv preprint arXiv: 2403.09954."},{"key":"10.1016\/j.eswa.2026.131318_bib0022","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2020.102687","article-title":"A swipe-based unlocking mechanism with supervised learning on smartphones: Design and evaluation","volume":"165","author":"Li","year":"2020","journal-title":"Journal of Network and Computer Applications"},{"key":"10.1016\/j.eswa.2026.131318_bib0023","series-title":"2019\u202fIEEE symposium on security and privacy (SP 2019)","first-page":"380","article-title":"Reasoning analytically about password-cracking software","author":"Liu","year":"2019"},{"key":"10.1016\/j.eswa.2026.131318_bib0024","series-title":"Intelligent cloud computing","article-title":"GenPass: A general deep learning model for password guessing with pcfg rules and adversarial generation","author":"Liu","year":"2018"},{"key":"10.1016\/j.eswa.2026.131318_bib0025","series-title":"2019\u202fIEEE 21st International conference on high performance computing and communications; IEEE 17th international conference on smart city; IEEE 5th international conference on data science and systems (HPCC\/smartcity\/DSS)","article-title":"Recurrent neural network based password generation for group attribute context-ware applications","author":"Luo","year":"2019"},{"key":"10.1016\/j.eswa.2026.131318_bib0026","series-title":"25th USENIX security symposium (USENIX security 16)","first-page":"175","article-title":"Fast, lean, and accurate: Modeling password guessability using neural networks","author":"Melicher","year":"2016"},{"issue":"20","key":"10.1016\/j.eswa.2026.131318_bib0027","doi-asserted-by":"crossref","first-page":"7306","DOI":"10.3390\/app10207306","article-title":"Generating optimized guessing candidates toward better password cracking from multi-dictionaries using relativistic GAN","volume":"10","author":"Nam","year":"2020","journal-title":"Applied Sciences"},{"key":"10.1016\/j.eswa.2026.131318_bib0028","series-title":"Proceedings of the 12th ACM conference on computer and communications security","first-page":"364","article-title":"Fast dictionary attacks on passwords using time-space tradeoff","author":"Narayanan","year":"2005"},{"key":"10.1016\/j.eswa.2026.131318_bib0029","series-title":"Proceedings of the 29th USENIX conference on security symposium","first-page":"2165","article-title":"That was then, this is now: A security evaluation of password generation, storage, and autofill in browser-based password managers","author":"Oesch","year":"2020"},{"key":"10.1016\/j.eswa.2026.131318_bib0030","series-title":"2019\u202fIEEE Symposium on security and privacy (SP)","first-page":"417","article-title":"Beyond credential stuffing: Password similarity models using neural networks","author":"Pal","year":"2019"},{"issue":"2","key":"10.1016\/j.eswa.2026.131318_bib0031","doi-asserted-by":"crossref","first-page":"409","DOI":"10.1007\/s10207-021-00560-9","article-title":"Password guessers under a microscope: An in-depth analysis to inform deployments","volume":"21","author":"Parish","year":"2022","journal-title":"International Journal of Information Security"},{"key":"10.1016\/j.eswa.2026.131318_bib0032","series-title":"30th USENIX security symposium (USENIX security 21)","first-page":"821","article-title":"Reducing bias in modeling real-world password strength via deep learning and dynamic dictionaries","author":"Pasquini","year":"2021"},{"key":"10.1016\/j.eswa.2026.131318_bib0033","series-title":"2021\u202fIEEE Symposium on security and privacy (SP)","first-page":"1382","article-title":"Improving password guessing via representation learning","author":"Pasquini","year":"2021"},{"key":"10.1016\/j.eswa.2026.131318_bib0034","series-title":"John the ripper password cracker","author":"Peslyak","year":"2021"},{"key":"10.1016\/j.eswa.2026.131318_bib0035","unstructured":"Radford, A., Narasimhan, K., Salimans, T., Sutskever, I. et al. (2018). Improving language understanding by generative pre-training. 1-12."},{"issue":"8","key":"10.1016\/j.eswa.2026.131318_bib0036","first-page":"9","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford","year":"2019","journal-title":"OpenAI Blog"},{"key":"10.1016\/j.eswa.2026.131318_bib0037","series-title":"European symposium on research in computer security","first-page":"164","article-title":"PassGPT: Password modeling and (guided) generation with large language models","author":"Rando","year":"2023"},{"key":"10.1016\/j.eswa.2026.131318_bib0038","series-title":"Hashcat","author":"Steube","year":"2018"},{"key":"10.1016\/j.eswa.2026.131318_bib0039","series-title":"2024 54th annual IEEE\/IFIP international conference on dependable systems and networks (DSN)","first-page":"429","article-title":"PagPassGPT: Pattern guided password guessing via generative pretrained transformer","author":"Su","year":"2024"},{"key":"10.1016\/j.eswa.2026.131318_bib0040","first-page":"3104","article-title":"Sequence to sequence learning with neural networks","author":"Sutskever","year":"2014","journal-title":"Neural Information Processing Systems"},{"key":"10.1016\/j.eswa.2026.131318_bib0041","series-title":"24th USENIX security symposium (USENIX security 15)","first-page":"463","article-title":"Measuring {Real-World} accuracies and biases in modeling password guessability","author":"Ur","year":"2015"},{"key":"10.1016\/j.eswa.2026.131318_bib0042","first-page":"6000","article-title":"Attention is all you need","volume":"30","author":"Vaswani","year":"2017","journal-title":"Neural Information Processing Systems"},{"issue":"3","key":"10.1016\/j.eswa.2026.131318_bib0043","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3448608","article-title":"A large-scale analysis of the semantic password model and linguistic patterns in passwords","volume":"24","author":"Veras","year":"2021","journal-title":"ACM Transactions on Privacy and Security (TOPS)"},{"key":"10.1016\/j.eswa.2026.131318_bib0044","series-title":"2016 46th annual IEEE\/IFIP international conference on dependable systems and networks (DSN)","first-page":"595","article-title":"FuzzyPSM: A new password strength meter using fuzzy probabilistic context-free grammars","author":"Wang","year":"2016"},{"issue":"4","key":"10.1016\/j.eswa.2026.131318_bib0045","first-page":"708","article-title":"Two birds with one stone: Two-factor authentication with security beyond conventional bound","volume":"15","author":"Wang","year":"2016","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"10.1016\/j.eswa.2026.131318_bib0046","series-title":"Proceedings of the 2016\u202fACM SIGSAC conference on computer and communications security","first-page":"1242","article-title":"Targeted online password guessing: An underestimated threat","author":"Wang","year":"2016"},{"issue":"8","key":"10.1016\/j.eswa.2026.131318_bib0047","first-page":"1519","article-title":"Password guessing based on recurrent neural networks and generative adversarial networks","volume":"44","author":"Wang","year":"2021","journal-title":"Chin. J. Comput"},{"key":"10.1016\/j.eswa.2026.131318_bib0048","series-title":"2009 30th IEEE symposium on security and privacy","first-page":"391","article-title":"Password cracking using probabilistic context-free grammars","author":"Weir","year":"2009"},{"issue":"5","key":"10.1016\/j.eswa.2026.131318_bib0049","doi-asserted-by":"crossref","first-page":"1323","DOI":"10.1109\/TMM.2019.2940877","article-title":"GenPass: A multi-source deep learning model for password guessing","volume":"22","author":"Xia","year":"2019","journal-title":"IEEE Transactions on Multimedia"},{"key":"10.1016\/j.eswa.2026.131318_bib0050","series-title":"Computational science and engineering","article-title":"Password guessing based on LSTM recurrent neural networks","author":"Xu","year":"2017"},{"key":"10.1016\/j.eswa.2026.131318_bib0051","series-title":"Proceedings of the 2021\u202fACM SIGSAC conference on computer and communications security","first-page":"5","article-title":"Chunk-level password guessing: Towards modeling refined password composition representations","author":"Xu","year":"2021"},{"key":"10.1016\/j.eswa.2026.131318_bib0052","series-title":"32nd USENIX security symposium (USENIX security 23)","first-page":"1001","article-title":"Improving real-world password guessing attacks via bi-directional transformers","author":"Xu","year":"2023"},{"key":"10.1016\/j.eswa.2026.131318_bib0053","series-title":"2025\u202fIEEE Symposium on security and privacy (SP)","article-title":"RankGuess: Password guessing using adversarial ranking","author":"Yang","year":"2024"},{"key":"10.1016\/j.eswa.2026.131318_bib0054","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2021.103162","article-title":"Touch-based continuous mobile device authentication: State-of-the-art, challenges and opportunities","volume":"191","author":"Zaidi","year":"2021","journal-title":"Journal of Network and Computer Applications"},{"key":"10.1016\/j.eswa.2026.131318_bib0055","series-title":"International conference on computer communications and networks","first-page":"1","article-title":"A preliminary analysis of password guessing algorithm","author":"Zhang","year":"2020"},{"key":"10.1016\/j.eswa.2026.131318_bib0056","series-title":"Proceedings of the 8th international conference on communication and network security","first-page":"79","article-title":"A password cracking method based on structure partition and bilstm recurrent neural network","author":"Zhang","year":"2018"},{"issue":"6","key":"10.1016\/j.eswa.2026.131318_bib0057","doi-asserted-by":"crossref","first-page":"2237.0","DOI":"10.1007\/s12083-020-00893-7","article-title":"CSNN: Password guessing method based on chinese syllables and neural network","volume":"13","author":"Zhang","year":"2020","journal-title":"Peer-to-Peer Networking and Applications"},{"issue":"27","key":"10.1016\/j.eswa.2026.131318_bib0058","first-page":"1","article-title":"Password guessing based on GAN with gumbel-softmax","volume":"2022","author":"Zhou","year":"2022","journal-title":"Security and Communication Networks"},{"key":"10.1016\/j.eswa.2026.131318_bib0059","series-title":"34th USENIX security symposium (USENIX security 25)","first-page":"7799","article-title":"Password guessing using large language models","author":"Zou","year":"2025"}],"container-title":["Expert Systems with Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417426002319?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417426002319?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T17:45:23Z","timestamp":1778780723000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0957417426002319"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5]]},"references-count":59,"alternative-id":["S0957417426002319"],"URL":"https:\/\/doi.org\/10.1016\/j.eswa.2026.131318","relation":{},"ISSN":["0957-4174"],"issn-type":[{"value":"0957-4174","type":"print"}],"subject":[],"published":{"date-parts":[[2026,5]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"PGMaP: Password generation based on mask prediction","name":"articletitle","label":"Article Title"},{"value":"Expert Systems with Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.eswa.2026.131318","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"131318"}}