CCUPP: Chinese Common User Passwords Profiler

Abstract.We evaluate CCUPP, a rule-based targeted password guessing tool for Chinese users, against CUPP (the de-facto standard) and published results from six academic papers spanning CCS 2016 to S&P 2025. Using five standard profiles and a 200-record synthetic PII–password paired dataset modelled after real Chinese password patterns (Li et al., USENIX Security 2014), we measure generation performance, PII embedding rate, dataset hit rate, and Success Rate @ N. CCUPP achieves 84% coverage and SR@1000 = 45.5% — comparable to TarGuess-III’s 45.4% — with 9× higher generation speed than CUPP and zero training data, GPU, or external dependencies.

1.Key Results

2.Generation Performance

We measure password generation throughput across five standard benchmark profiles — three Chinese (zh_full, zh_minimal, zh_medium) and two English (en_full, en_minimal). All measurements are wall-clock on a single CPU thread.

3.PII Embedding Rate

Fraction of generated candidates that contain a fragment of the target’s personal information. Higher rates indicate more targeted generation. The Personal-PCFG study (Li et al., USENIX Security 2014) observed that 60.1% of Chinese users embed PII in their passwords.

4.Academic Comparison: Success Rate @ N

The primary metric in the targeted password guessing literature. Given a PII–password paired dataset, what fraction of target passwords appears within the first N guesses? CCUPP and CUPP rows are measured on 200 synthetic records modelled after real Chinese password patterns; the remaining baselines are reported numbers from their respective papers on real leaked corpora — see fair-comparison caveat in §6.

5.Guess-Number and Distribution Statistics

For passwords that were ultimately found, at what rank in the generated list did they appear? Lower ranks indicate better priority ordering.

The two tools also produce nearly disjoint candidate sets, suggesting they could be productively combined. Length distributions differ markedly: CUPP concentrates 82% of its output in the 9–12 character range, while CCUPP spreads across 1–24 characters in line with observed Chinese password length distributions.

6.Discussion

Strengths.

CCUPP achieves SR@1000 = 45.5%, on par with TarGuess-III (45.4%, CCS 2016) which requires training on leaked password corpora. At SR@10⁴ = 84.0%, CCUPP covers the vast majority of targets in our set. Its 48.2% PII embedding rate on zh_full — versus CUPP’s 33.2% — confirms more targeted candidate generation. CCUPP is roughly 9× faster than CUPP with zero training data, zero GPU, and no dependency beyond a pip install.

Limitations.

CCUPP’s SR@100 = 1.0% trails academic models substantially (TarGuess 19.7%, PassLLM 31.6%). The median hit-rank of 686 indicates that CCUPP places correct passwords in the hundreds-to-thousands range rather than within the top 100. For online-attack scenarios with strict guess budgets (N ≤ 100), trained probabilistic models remain decisively ahead. Improving priority ordering — for instance via frequency-weighted rules — is the most promising direction for future work.

Fair-comparison caveat.

The academic baselines (TarGuess, PassLLM, etc.) were evaluated on real leaked PII–password datasets — typically 12306, Dodonew — with 10⁵-plus records. Our evaluation uses 200 synthetic records modelled after published Chinese password patterns. The comparison is therefore directionally informative but not strictly equivalent.

Positioning.

CCUPP occupies a distinct niche: to our knowledge it is the only actively maintained, rule-based, Chinese-localised password profiling tool that requires neither training data nor GPU. Its SR@1000 matches TarGuess-III, making it a pragmatic alternative for penetration testers who cannot deploy machine-learning infrastructure.

7.References