Accepted — ICDSCNC 2026IEEE Xplore

Evaluating LSTM-Based Password Guessing

Under Argon2id Memory-Hard Constraints

Evaluates how effectively a character-level LSTM password guesser performs against credentials protected by Argon2id's memory-hard parameters, compared to a classical n-gram baseline.

LSTMArgon2idPython

2-layer LSTMArchitecture256 hidden units

2.29Validation loss

5.41×Efficiency vs. 3-gram Markov baseline

0.87%Attack match rate

666,401Credentials evaluated

PROBLEM

Memory-hard password hashing schemes like Argon2id are designed to make brute-force and dictionary attacks expensive. Whether a learned password-guessing model changes that calculus in practice is not obvious from the KDF parameters alone.

APPROACH

Trains a 2-layer character-level LSTM (256 hidden units) as a password-guessing model and evaluates its guess efficiency against credentials hashed with Argon2id (m=65536, t=3, p=4), benchmarked against a classical 3-gram Markov baseline.

IMPLEMENTATION

Character-level LSTM trained to convergence at a validation loss of 2.29, then used to generate guesses evaluated against a held-out set of 666,401 real-world credentials under the fixed Argon2id parameters.

RESULTS

The LSTM guesser is 5.41× more efficient than the 3-gram Markov baseline at generating high-likelihood guesses, but achieves only a 0.87% match rate against the evaluated credential set under Argon2id's memory-hard constraints.

LIMITATIONS

The low absolute match rate reflects Argon2id's cost parameters constraining the number of guesses that are practical to attempt; results are specific to the chosen m/t/p parameters and the evaluated credential distribution.