I built this site while exploring password cracking during my cybersecurity journey. Instead of just watching Hashcat run for hours or days, I wanted to find smarter, more efficient ways to crack passwords by recognizing patterns. VowelFreq is a statistical analysis tool designed to optimize password cracking by leveraging vowel frequency and character positioning within words from the dictionary. Traditional brute-force attacks waste significant time testing unrealistic letter combinations. By analyzing word structures and separating vowels (aeiou) from non-vowels (bcdfghjklmnpqrstvwxyz), we can drastically reduce the keyspace required for effective cracking.
Hashcat allows up to four custom charsets [read more here] (?1 to ?4). By strategically assigning:
?1 → Vowel-only charset (aeiou)
?2 → Non-vowel charset (bcdfghjklmnpqrstvwxyz)
We can leverage brute force attacks based on common word patterns. For example, instead of blindly attempting all 26⁸ 208 billion possible lowercase combinations for an eight-letter password, we recognize that such words often follow a vowel/non-vowel pattern. By reducing a non-vowel charset to 21 characters by removing the vowels and create a vowel only charset, we could run the same eight-letter brute force with ?2?1?2?2?1?2?1?2, which would reduce the keyspace to ((21⁵) + (5³)) or 4 million possibilities! We can take this a step further by adding known numbers with the vowel charset, 3 is commonly replaced by eE - known as leetspeak. View the charsets link at the top for more information.
While running a character analysis from the rockyou.txt wordlist, I discovered the following charset is based on the most common characters to the least common characters:
ae10i2onrls938t45m67cdyhubkgpjvfwzAxEILORNSM.TCD_BqHYK!U-PG*J@FVWZ/#$X,\+&=)?Q(';"<]%~:[^`>
-Created by diGi ([email protected])
Analyzing 402,056 dictionary words (last updated 2025-02-22)
| Word Length | 3 characters | 4 characters | 5 characters | 6 characters | 7 characters | 8 characters | 9 characters | 10 characters | 11 characters | 12 characters | 13 characters | 14 character | 15 characters |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Patterns | view | view | view | view | view | view | view | view | view | view | view | view | view |
| Total Words | 2,126 | 7,183 | 15,918 | 39,610 | 51,960 | 59,720 | 58,796 | 49,766 | 40,242 | 30,802 | 21,964 | 14,793 | 9,176 |
| 1 | 22.20% | 15.94% | 16.06% | 17.58% | 17.98% | 19.68% | 22.38% | 25.29% | 26.88% | 28.88% | 29.48% | 30.64% | 31.17% |
| 2 | 58.00% | 69.37% | 64.04% | 65.69% | 64.31% | 60.86% | 57.85% | 55.35% | 53.29% | 50.49% | 50.36% | 49.48% | 49.22% |
| 3 | 22.44% | 35.28% | 35.91% | 29.89% | 31.57% | 32.55% | 31.96% | 30.32% | 29.87% | 29.75% | 28.26% | 28.35% | 28.02% |
| 4 | 30.28% | 44.00% | 38.63% | 32.51% | 37.99% | 37.16% | 39.44% | 39.43% | 41.32% | 41.27% | 41.53% | 42.04% | |
| 5 | 27.44% | 53.67% | 50.44% | 36.16% | 42.79% | 40.23% | 42.02% | 39.47% | 41.00% | 40.15% | 38.46% | ||
| 6 | 28.92% | 48.02% | 52.54% | 35.27% | 42.08% | 36.29% | 39.67% | 36.55% | 38.22% | 38.09% | |||
| 7 | 25.77% | 46.21% | 54.90% | 37.09% | 47.50% | 40.94% | 46.24% | 41.26% | 43.70% | ||||
| 8 | 23.71% | 44.11% | 52.34% | 35.88% | 45.33% | 36.97% | 42.93% | 38.55% | |||||
| 9 | 23.32% | 46.45% | 52.74% | 37.14% | 48.72% | 38.94% | 44.25% | ||||||
| 10 | 23.48% | 47.24% | 53.61% | 37.02% | 49.72% | 40.88% | |||||||
| 11 | 21.94% | 47.59% | 55.18% | 36.10% | 49.74% | ||||||||
| 12 | 20.62% | 47.45% | 57.57% | 35.71% | |||||||||
| 13 | 18.79% | 45.21% | 58.38% | ||||||||||
| 14 | 17.01% | 43.40% | |||||||||||
| 15 | 14.36% |