PAGES
← all tools
◆ Password & Credential Cracking

maskprocessor

open-source

Maskprocessor is a high-performance word generator with a per-position configurable charset

source ↗ rss ↗ What is a cyber toolchain?

Summary

maskprocessor is an open-source, MIT-licensed word generator that produces password candidates from a per-position configurable mask instead of a plain charset, and it runs as a single stand-alone command-line binary on Linux or Windows. It is built for people doing password cracking, typically alongside hashcat, letting them shrink a brute-force keyspace down to patterns real humans actually use, such as a capitalized name followed by a four-digit year, cutting a multi-year search to minutes. Its documentation and README present it as a component of the hashcat toolset rather than a standalone competitor, generating candidate lists that feed into a separate cracking engine. First committed in 2015 with 8 contributors, it has had no commits in the past year, so treat it as stable but no longer actively developed.

Maskprocessor is a high-performance word generator with a per-position configurable charset

How maskprocessor helps

Which password candidates should get tried first against a hash that looks like a name followed by a date?

builds candidates position by position from a mask string, so the first slot draws from an upper-case letter set and later slots draw from digits, matching the pattern real people use instead of enumerating every character everywhere

Is a full mixed-case-plus-digit keyspace actually worth searching, or can the search space be narrowed first?

lets each position take its own charset, so a search that would otherwise cover every upper/lower/digit combination at every slot can be pinned down to the slots where that variation actually occurs, cutting the total combinations tried

Can a partially-known password be resumed from a specific guess instead of starting over?

accepts a starting word to resume candidate generation from that exact position in the keyspace, so a stopped or split job can pick up rather than regenerating everything before it

How many candidates will a given mask actually produce before running the job?

calculates the total combinations for the configured mask up front without generating them, so the size of the search can be checked against available time or cracking rate before committing to the run

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities

Built from maskprocessor's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

All capabilities 4 capabilities
Masked Password Generation shipped Generates password candidates based on configurable per-position character masks. 7 other sources

docs

  • High-Performance word generator with a per-position configurable charset -1, --custom-charset1=CS User-definable charsets John the Ripper (using --stdout ) seen Oct 2026 · source
  • hashcat charset files hashcat mask files Using a mask with a trained grammar There is no inherent disadvantage: a mask can describe the same keyspace as an unrestricted brute-force attack, or a smaller one when you have useful information about the password. seen Oct 2026 · source
  • High-performance word generator that produces password candidates from configurable per-position character masks.

example

  • Three-char subset charset combinations -1 efghijklmnop ?1?1?1
  • Name plus year pattern keyspace -1 ?l?u ?1?l?l?l?l?l19?d?d
  • Append single digit to static word password?d
  • Generate all 8-char lowercase combinations ?l?l?l?l?l?l?l?l
Hybrid Word-Mask Attack documented Generates password candidates by embedding a dictionary word at a configurable position within a mask pattern (attack mode 12). 3 other sources

docs

  • Attack mode 12: place a word within a mask - you write a mask and mark inside it where the word goes Attack mode 12: place a word within a mask Attack mode 12 is in hashcat's master branch and is not in the 7.1.2 release, which prints below are in the release and need no extra build. seen Oct 2026 · source
  • Converter Using a mask together with a wordlist Using a mask together with a wordlist A mask does not have to stand on its own. seen Sep 2026 · source
  • hashcat advanced password recovery hashcat Forums Wiki Tools Events Converter Table of Contents Hybrid Attack Description Attack mode 12, the mask says where the word goes The ?w marker A second dictionary with ?q Attack mode 6, word then mask Attack mode 7, mask then word Rules on the words Using rules instead Hybrid… seen Sep 2026 · source
Custom Charset Combination shipped Combines multiple custom character sets for password generation. 2 other sources

example

  • Custom charset mixing letters and digits -1 ?l?d ?1?1?1?1?1
  • Two custom charsets combined -1 ?dabcdef -2 ?l?u ?1?1?2?2?2?2?2
PCFG Attack documented Generates password candidates using probabilistic context-free grammars, supporting custom rulesets and training on specific language corpora. 1 other source

docs

  • hashcat advanced password recovery hashcat Forums Converter Table of Contents PCFG Attack Description Why you would use it Running it What a ruleset looks like Using more than one ruleset Holding it to a shape A literal is not a filter on the output Training your own ruleset Training a ruleset for another language 1. seen Oct 2026 · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for maskprocessor, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail maskprocessor puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Nothing shipped since we started watching. Releases and docs updates land here as they happen.

last release Feb 9, 2015 · watching since Jun 24, 2026

Project health

Issue, contributor and maintainer activity in hashcat/maskprocessor, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

  1. Contributors 0 ±0 vs prior 12 months
  2. Maintainers 0 +0 joined · −0 left, last 12 months
  3. Bus factor 0 committers behind half the commits
  4. Community-filed 100% of issues opened, last 12 months
  5. Median time to close < 1 day first maintainer reply 2.7 hours
  6. Open backlog 14 of 28 issues ever filed
  1. Issues opened / month 0 · 0 communitymaintainers
  2. Open backlog 14
  3. Contributors / month 0
  4. Commits / month 0
  5. Stars 511
Issue themes, last 12 months
  • other 100%

Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

Libraries its release ships

What its latest release locks, checked against known advisories.

None of its release's images build from a lockfile we can read.

Add the badge to your README

Maintain this project? The badge links readers straight to this page, so they can follow every release here.

Tracked by Cyber Toolchain Choose a badge style and copy the code →
compare.md

    Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

    my-toolchain — 0 tools

      Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
      browse all tools → score card for your toolchain →
      cyber-toolchain / feedback

      Send us feedback