PAGES
← all tools
◆ Password & Credential Cracking

statsprocessor

open-source

Statsprocessor is a word-generator based on per-position markov-chains

source ↗ rss ↗ What is a cyber toolchain?

Summary

statsprocessor is an open-source command-line word generator that produces password candidates using per-position Markov chains built from hcstat statistics files, licensed under MIT so there's no cost to use. It ships as a single stand-alone binary for Linux, Windows and OSX, taking a mask and hcstat file as input and outputting statistically likely candidates rather than raw brute-force combinations. This makes it a fit for password auditors and penetration testers running hash-cracking workflows, particularly alongside hashcat itself, which the vendor documentation identifies as its parent project and the source of the markov-attack technique it implements. It sits in the wordlist-generation corner of the password-cracking space, distinct from dictionary or rule-based tools. Started in 2015 with five contributors, it has had no commits in the past year, suggesting the tool is stable but no longer under active development.

Statsprocessor is a word-generator based on per-position markov-chains

How statsprocessor helps

Which candidate passwords should get tried before a full brute-force run exhausts its time budget?

orders output by the per-position letter-following statistics learned from the training dictionary in the hcstat file, so the most statistically likely strings come first instead of every combination getting equal priority

Which password lengths are worth generating candidates for at all?

takes a minimum and maximum length as input and only produces candidates in that range, letting a cracking run be scoped to the lengths actually seen in past breaches or policies

Which character positions in a target's passwords follow predictable patterns from a known dataset?

builds its output from a table of which letter tends to follow which letter at each position, learned from whatever dictionary the hcstat was generated from, so the answer is only as good as that source dictionary

How much of the guessing space is actually being covered by a given mask and charset?

can calculate the total number of combinations a mask and hcstat would produce without generating them, so the size of a job is known before it runs

How do I resume a distributed cracking job across multiple machines without repeating work already done?

supports skipping a number of already-generated words and limiting how many more to produce, so a job can be split and picked back up at a known offset

Which output looks like plain mask-based brute-forcing instead of statistically-weighted guessing?

can disable the Markov weighting entirely to fall back to the same output a plain mask-based generator would produce, useful for comparing the two approaches on the same mask

all 3 features, with the evidence for each →

Languages

Not documented

Features

3 capabilities

Built from statsprocessor's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

All capabilities 3 capabilities
Password candidate generation from hcstat shipped Generates password candidates based on per-position Markov chains using hcstat files as input. 6 other sources

docs

  • Statsprocessor is a high-performance word generator based on per-position Markov statistics, provided as a single stand-alone binary. For a detailed description of how Markov ordering works, see the The current version is The program is available for Linux and Windows in both 32-bit and 64-bit versions. seen Oct 2026 · source
  • The Markov-ordered run starts with . The statistics file determines this order. With the same full keyspace, both runs test the same 1,000 candidates, but Markov ordering tries more likely candidates first. This helps when you stop the attack before it finishes. seen Oct 2026 · source
  • Converter Table of Contents Markov attack Description You can see it Where the statistics come from Per position, or not Cutting the tail off Generating your own table See also Markov attack Description Markov is not really an attack of its own. seen Sep 2026 · source
  • hashcat advanced password recovery hashcat Forums Wiki Tools Events Converter Table of Contents PCFG Attack Description Why you would use it Running it What a ruleset looks like Using more than one ruleset Training your own ruleset Training a ruleset for another language 1. Get a corpus 2. seen Sep 2026 · source
  • Word generator based on per-position Markov chains that produces password candidates from hcstat files.

example

  • Generate 5-char lowercase words from hcstat ./sp64.bin --pw-min 5 --pw-max 5 hashcat.hcstat ?l?l?l?l?l | head -9
Mask-based password candidate generation documented Generates password candidates by applying masks that define the keyspace, from a full brute-force range down to a narrowly constrained pattern when password structure is known. 3 other sources

docs

  • hashcat charset files hashcat mask files Using a mask with a trained grammar There is no inherent disadvantage: a mask can describe the same keyspace as an unrestricted brute-force attack, or a smaller one when you have useful information about the password. seen Oct 2026 · source
  • Holding it to a shape A literal is not a filter on the output Attack mode 4 is in hashcat's master branch and is not in the 7.1.2 release, which prints . The letter names which directory the parts come from, and the number is both a length and a file name, so token that defines which letters to upper-case afterwards. seen Oct 2026 · source
  • hashcat advanced password recovery hashcat Forums Wiki Tools Events Converter Table of Contents Mask Attack Description Advantage over Brute-Force Disadvantage compared to Brute-Force Masks Output Built-in charsets Custom charsets Examples Default mask Example Password length increment Hashcat charset files Hashcat… seen Sep 2026 · source
Custom charset definition documented Allows users to define custom character sets that can be referenced in masks and other attack configurations. 2 other sources

docs

  • -1, --custom-charset1=CS User-definable charsets There is no known alternative that can handle markov like this, but the following programs can at least generate wordlists and are partially configurable: John the Ripper (using --stdout ) seen Oct 2026 · source
  • hashcat advanced password recovery hashcat Forums Wiki Tools Events Converter Table of Contents Mask Attack Description Advantage over Brute-Force Disadvantage compared to Brute-Force Masks Output Built-in charsets Custom charsets Examples Default mask Example Password length increment Hashcat charset files Hashcat… seen Sep 2026 · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for statsprocessor, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail statsprocessor puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Nothing shipped since we started watching. Releases and docs updates land here as they happen.

last release Feb 9, 2015 · watching since Jun 24, 2026

Project health

Issue, contributor and maintainer activity in hashcat/statsprocessor, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

  1. Contributors 0 ±0 vs prior 12 months
  2. Maintainers 0 +0 joined · −0 left, last 12 months
  3. Bus factor 0 committers behind half the commits
  4. Community-filed 100% of issues opened, last 12 months
  5. Median time to close < 1 day first maintainer reply 17 hours
  6. Open backlog 1 of 11 issues ever filed
  1. Issues opened / month 1 · 0 communitymaintainers
  2. Open backlog 1
  3. Contributors / month 0
  4. Commits / month 0
  5. Stars 200
Issue themes, last 12 months
  • other 100%

Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

Libraries its release ships

What its latest release locks, checked against known advisories.

None of its release's images build from a lockfile we can read.

Add the badge to your README

Maintain this project? The badge links readers straight to this page, so they can follow every release here.

Tracked by Cyber Toolchain Choose a badge style and copy the code →
compare.md

    Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

    my-toolchain — 0 tools

      Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
      browse all tools → score card for your toolchain →
      cyber-toolchain / feedback

      Send us feedback