I'm working on a password brute-forcer that takes in a password from the user and brute-forces solutions until it finds a match. I was wondering if there is any way to improve performance or readability?

import itertools
import time

Alphabet = ("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXiuYZ1234567890-_.")

Password = input("What is your password?\n")

start = time.time()

counter = 1

CharLength = 1

for CharLength in range(25):

    passwords = (itertools.product(Alphabet, repeat = CharLength))


    print("Currently working on passwords with ", CharLength, " characters.")
    print("We are currently at ", (counter / (time.time() - start)), "attempts per second.")
    print("It has been ", time.time() - start, " seconds.")
    print("We have tried ", counter, " possible passwords.")

    for i in passwords:

        counter += 1

        i = str(i)

        i = i.replace("[", "")
        i = i.replace("]", "")
        i = i.replace("'", "")
        i = i.replace(" ", "")
        i = i.replace(",", "")
        i = i.replace("(", "")
        i = i.replace(")", "")

        if i == Password:

            end = time.time()

            timetaken = end - start

            print("\nPassword found in ", timetaken, " seconds and ", counter, "attempts.")

            print("That is ", counter / timetaken, " attempts per second.")

            print("\nThe password is \"%s\"." % i)

            input("\nPress enter when you have finished.")



  • \$\begingroup\$ What would this code be used for? It asks for the plain text password, not a hash, and just iterates over all possible strings of length 0 through 24 until it matches what it already knows. \$\endgroup\$ – l0b0 Oct 15 '18 at 3:02
  • \$\begingroup\$ @l0b0 I'll later implement some sort of web form functionality. \$\endgroup\$ – Michael O'Connell Oct 20 '18 at 19:04

Some recommendations just looking at the style of the code:

  1. It would benefit from being run through pycodestyle, flake8 and/or similar tools to be more idiomatic. This would make the code easier to read for anyone familiar with Python.
  2. Timing code should not be part of your program. External tools like time can handle that.
  3. Use argparse rather than input to make the program scriptable. The script should not stop anywhere to ask for input.
  4. The Alphabet and 25 in this code are good candidates for configuration or parameters.
  5. You can remove all of a list of characters from a string in a single command.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.