Home > Mask attack
Mask attack
Office password recovery tools
Guaranteed password recovery for Microsoft Office documents with 40-bit encryption
Reset Windows Password v10.5
Introducing system and interface restrictions editor
WPA password recovery benchmarks
New CPU and GPU devices
Reset Windows Password v10.4.1
Support for Windows 10 21H1 and some extra enhancements

Articles and video

You may find it helpful to read our articles on Windows security and password recovery examples. Video section contains a number of movies about our programs in action

Mask attack

Often the mask attack used if there's some information about the password to recover. For example, you know that the password begins with 'loveme' and followed by a word or a name. You can then set the following mask 'loveme%c%c%c%c%c%c' to check all possible variants from 'lovemeaaaaaa' to 'lovemezzzzzz'.

Mask attack

The mask entry field is used for setting the rule, by which the program will try to recover the password. If the mask is set correctly, below you will see the range of characters generated by the mask. User-defined masks can be saved to disk. You can also use the mask tool to generate a dictionary.


The password mask consists of static not changing characters and special sets - dynamically changing letters, numbers or symbols. For example, in the mask 'secret%d(1-100)', the characters 's' 'e' 'c' 'r' 'e' 't' are static, and '%d(1-100)' is the dynamical set. A dynamical set is always marked with % character.

The program supports the following dynamical sets:

Dynamical set Description
%c lower-case Latin characters (a..z), 26 symbols
%C upper-case Latin characters (A..Z), 26 symbols
%# full set of special characters (!..~ space), total 33 symbols
%@ small set of special characters (!@#$%^&*()-_+= space), 15 symbols
%? all printable characters with ASCII codes of 32..127
%d one digit (0..9)
%d(x-y) numbers between x and y inclusive
%r(x-y) user-defined characters with serial ASCII codes between x and y
%r(x1-y1,x2-y2...xn-yn) set of several non-overlapping sequences of ASCII characters. Useful for defining custom character sets; e.g., of OEM characters.
%l(n) link to another set from mask, 1 based
%% standalone static character %

When setting %r, keep in mind that the range of defined OEM characters (with character code greater than 127) is generated using the DOS encoding.

test%d - will generate password range test0..test9, 10 passwords total
test%d(1980-2007) - test1980..test2007, 28 passwords
test%r(48-57,97-122) - test0..testz, 36 passwords
%#test%# - _test_..~test~, 1089 passwords
%d(1-12)%r(45-47)%d(1-31)%l(2)%d(1980-2010) - 1-1-1980..12/31/2010, 34596 passwords
%c%r(32-63)%c%l(2)%c%l(2)%c - a_a_a_a..z?z?z - 14623232 passwords