FGPass: Feature-guided targeted password guessing with gated fine-tuning strategy

Most targeted password guessing models rely on users' personal information, while neglecting the intrinsic features of the passwords themselves. To address this, we propose FGPass, a feature-guided model designed to generate high-quality passwords adhering to specific constraints. Furthermore, to enhance cross-site adaptability, we introduce GAFT, a gated fine-tuning strategy that adapts the model using cracked password pairs for secondary guessing. Extensive evaluations demonstrate that FGPass achieves an average hit rate of 28.30% across multiple attack scenarios, outperforming all baselines. Its ability to learn and guide the guessing process using password features proves critically effective under stringent constraints, delivering a performance gain of 20.81% compared to the best competitor. Additionally, GAFT yields an extra performance improvement of 6.37% over the initial guessing round and outperforms full-parameter fine-tuning by 48.08%, demonstrating its strong capability in capturing site-specific transformation behaviors. Finally, we highlight the utilization of correlated password features as a vital direction for future research.