  Large language models (LLMs) successfully model natural language from vast
amounts of text without the need for explicit supervision. In this paper, we
investigate the efficacy of LLMs in modeling passwords. We present PassGPT, a
LLM trained on password leaks for password generation. PassGPT outperforms
existing methods based on generative adversarial networks (GAN) by guessing
twice as many previously unseen passwords. Furthermore, we introduce the
concept of guided password generation, where we leverage PassGPT sampling
procedure to generate passwords matching arbitrary constraints, a feat lacking
in current GAN-based strategies. Lastly, we conduct an in-depth analysis of the
entropy and probability distribution that PassGPT defines over passwords and
discuss their use in enhancing existing password strength estimators.
